Task 5.3: Troubleshoot network connectivity issues.

• AAdd an outbound security group rule that allows TCP 1024-65535 to 0.0.0.0/0

  Incorrect

  Security groups are stateful, so responses to allowed inbound traffic are allowed anyway, and the default outbound rule already allows all traffic.

• BAdd an inbound security group rule that allows TCP 1024-65535 from 0.0.0.0/0

  Incorrect

  The inbound request is already accepted. Opening more inbound ports does not let the response leave.

• CAdd a 0.0.0.0/0 route to the internet gateway in the subnet's route table

  Incorrect

  A REJECT record means the traffic was not allowed by a security group or network ACL, not that a route was missing.

• DAdd an outbound network ACL rule that allows TCP 1024-65535 to 0.0.0.0/0

  Correct

  Network ACLs are stateless, so response traffic needs its own rule. Allowed inbound traffic whose response is rejected is the pattern AWS describes for a network ACL that lacks the outbound rule.

ACCEPT in, REJECT out on the same flow points to the stateless layer: the network ACL needs an outbound rule for the clients' ephemeral ports.

• AVPC flow logs on both network interfaces, reviewed after a new connection attempt

  Incorrect

  Flow logs record accepted or rejected traffic that actually flows, and a REJECT does not say which security group or network ACL rule caused it.

• BVPC Reachability Analyzer, with a path from the instance to the DB instance on port 5432

  Correct

  Reachability Analyzer analyzes the configuration between a source and a destination and, when the destination is unreachable, names the blocking component.

• CA Traffic Mirroring session that copies the instance's packets to a monitoring appliance

  Incorrect

  Traffic Mirroring copies real network traffic for inspection. It needs traffic and does not evaluate the configuration.

• DThe CloudTrail event history for the week's network changes

  Incorrect

  CloudTrail records who took which action. It does not show whether the resulting configuration blocks this path, or where.

Reachability Analyzer is configuration analysis: it walks route tables, network ACLs, security groups and load balancers and points at the hop that blocks.

• ACreate an invalidation for the /* path every hour so that the edge caches stay fresh

  Incorrect

  Invalidation removes files from the edge caches, which sends even more requests back to the origin.

• BLower the minimum, default and maximum TTLs in the cache policy

  Incorrect

  Shorter TTLs keep files in the cache for less time, so fewer requests are served from it.

• CKey the cache on id only; send the cookie through an origin request policy

  Correct

  Fewer values in the cache key raise the chance of a hit, and an origin request policy sends information to the origin without adding it to the cache key.

• DTurn on CloudFront standard logging for the distribution

  Incorrect

  Access logs record each request for analysis and troubleshooting. They do not change what is cached.

A low hit ratio usually means a fragmented cache key. Keep in the key only what changes the response, and send the rest to the origin through an origin request policy.

• AAttach an internet gateway to the VPC and route 10.50.0.0/16 to it

  Incorrect

  The VPN terminates on the virtual private gateway. Routes to the data center must point there, not to an internet gateway.

• BTurn on DNS hostnames for the VPC

  Incorrect

  DNS attributes affect name resolution inside the VPC. They do not create a route or allow traffic.

• CTurn on route propagation from the virtual private gateway on the subnet's route table

  Correct

  Traffic from the VPC reaches the customer gateway only if the route table holds the VPN's routes pointing to the virtual private gateway; propagation adds them automatically.

• DAdd an inbound security group rule that allows SSH from 10.50.0.0/16

  Correct

  To allow access to instances from the remote network, the security group must allow the inbound traffic from that network.

• EAssociate an Elastic IP address with each of the instances in the private subnet

  Incorrect

  An Elastic IP address is a public address for internet communication. VPN traffic uses the instances' private addresses.

A tunnel that is UP still needs two things on the VPC side: a route to the remote network through the virtual private gateway, and security group rules that let the remote network in.