An EC2 instance in one VPC can't reach an RDS instance in a peered VPC. Security groups look correct. Which AWS tool analyzes the full network path — route tables, NACLs, peering — and identifies the blocking hop?
A.VPC Flow Logs
Flow Logs record actual traffic flows; they don't diagnose why a path fails.
B.VPC Reachability Analyzer
Correct. Purpose-built hop-by-hop path analysis.
C.AWS Network Firewall
Network Firewall filters traffic — it's not a diagnostic tool.
D.Amazon Route 53 health checks
Health checks monitor endpoints, not network paths.
Why this answer
Reachability Analyzer performs path analysis between a source and destination — evaluating route tables, security groups, NACLs, and peering — and reports exactly which component blocks the path. Flow Logs show observed traffic but don't analyze the intended path.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Operations practice session.
Practice Network Operations