An app can't reach an RDS instance and the team wants to verify — without sending traffic — whether a network path exists between the EC2 instance and the database through route tables, SGs, and NACLs. Which tool analyzes this?
A.VPC Flow Logs
Flow Logs record actual traffic — they can't test a hypothetical path.
B.VPC Reachability Analyzer
Correct. Config-level path analysis, no packets sent.
C.CloudWatch Network Monitor
Network Monitor measures live connectivity performance.
D.ping and traceroute from the instance
Requires the path working already; doesn't isolate which rule blocks.
Why this answer
Reachability Analyzer performs configuration-path analysis — it evaluates routes, SGs, NACLs, TGW attachments, and peering to answer 'is a path possible' without packets. Flow Logs show what already flowed; ping tests the live path but requires the app already working.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Operations practice session.
Practice Network Operations