ANS-C01 Traffic Analysis and Connectivity Troubleshooting Guide

Traffic analysis questions on ANS-C01 are about choosing the fastest evidence path. The exam expects you to decide whether the failure is likely route configuration, security policy, DNS, packet size, packet loss, appliance behavior, topology, or application behavior before selecting a tool.

The current AWS task statement is to monitor and analyze network traffic to troubleshoot and optimize connectivity patterns. The official scope names CloudWatch, VPC Flow Logs, VPC Traffic Mirroring, Reachability Analyzer, Transit Gateway Network Manager, packet size, packet loss, topology mapping, and automated verification of connectivity intent.

What the exam is really testing

The common wrong answer is using the deepest tool first. Packet capture is powerful, but it is often slower and less appropriate than checking reachability, routes, flow logs, or service logs.

Tool chooser

Troubleshooting decision flow

Use this sequence before jumping into packet capture.

    flowchart LR
	  S["Symptom"] --> P["Define source, destination, protocol, port"]
	  P --> R["Analyze configured reachability"]
	  R --> F["Check flow and service logs"]
	  F --> M["Check metrics, topology, and baselines"]
	  M --> K["Mirror packets only if packet detail is needed"]
	  K --> V["Validate fix and automate the check"]

This is the operational version of the design model. The right tool depends on the layer of doubt.

Reachability Analyzer is configuration proof

Reachability Analyzer builds a model of the network configuration and checks whether the specified path is reachable. It does not send live packets or measure live data-plane performance.

Use it when:

• a new route table, security group, NACL, gateway, peering connection, Transit Gateway attachment, endpoint, or VPN gateway may block the path
• the question asks for the blocking component
• the network must prove that a design requirement is still satisfied after a change
• automation should verify connectivity intent during deployment

Do not use Reachability Analyzer as the first answer for packet loss, congestion, application latency, payload inspection, or intermittent runtime behavior.

Flow logs are flow evidence, not packet capture

VPC Flow Logs and Transit Gateway Flow Logs are strong for understanding which IP flows were observed and whether they were accepted or rejected at the logging point.

Flow logs are not real-time packet captures and do not show packet payload. They are often the best first tool, but they are not the final answer for every problem.

Traffic Mirroring is deep inspection

Traffic Mirroring copies selected network traffic from supported elastic network interfaces to monitoring or security appliances. It is strong when the question needs packet-level evidence.

Use Traffic Mirroring when:

• packet contents, flags, fragmentation, or handshake behavior matter
• an IDS/NDR appliance needs traffic visibility
• packet shaping, unusual retransmissions, or protocol behavior must be inspected
• flow logs and route analysis cannot explain the symptom

Avoid choosing Traffic Mirroring just because the prompt says “monitoring.” If the prompt asks whether a security group or route table blocks a path, Reachability Analyzer and flow logs are usually stronger first.

Packet size and MTU clues

ANS-C01 explicitly includes packet size mismatches. These questions often describe a path that is correct for small packets but unreliable for larger payloads.

Do not assume every intermittent failure is security-group related. Packet size, tunnel overhead, and fragmentation can explain scenarios where routing appears correct.

Topology and hybrid troubleshooting

Transit Gateway Network Manager and CloudWatch are strong when the problem spans multiple attachments, Regions, or on-premises networks.

Hybrid troubleshooting is not AWS-only. If the problem crosses Direct Connect, VPN, or customer routers, include on-premises telemetry and BGP evidence.

Service logs versus network logs

Sometimes the network delivered the packet and the managed service rejected or mishandled the request.

Flow logs can prove that packets moved. They cannot explain every HTTP status code, TLS negotiation problem, or application response.

Common scenario patterns

Exam eliminations

Troubleshooting order

When the scenario describes traffic loss or degraded connectivity, use this order:

1. Define the expected source, destination, protocol, port, direction, and name resolution path.
2. Determine whether the question is about configured reachability, live flow behavior, packet detail, topology, or service response.
3. Use Reachability Analyzer if configuration correctness is uncertain.
4. Use VPC or Transit Gateway Flow Logs if accepted/rejected flow evidence is needed.
5. Use CloudWatch, Network Manager, and route tables for topology, trend, and hybrid evidence.
6. Use service logs when the managed service received the request.
7. Use Traffic Mirroring when packet-level behavior remains the likely unknown.
8. Validate the fix and, when possible, automate the check so future changes do not reintroduce the issue.

Sample exam question

A company deployed a new route table and security group change for an internal service. After the change, clients in one VPC cannot reach the service in another VPC through Transit Gateway. The operations team wants to identify whether the AWS configuration still permits the expected TCP path and which component blocks it if it does not. Which tool should be used first?

• VPC Traffic Mirroring on every workload ENI.
• VPC Reachability Analyzer for the source, destination, protocol, and port.
• CloudFront access logs.
• Route 53 weighted routing.

Answer: Use Reachability Analyzer.

Why: The question asks whether the configured path permits reachability and which component blocks it. Reachability Analyzer is the right static configuration analysis tool. Traffic Mirroring is deeper than needed and does not identify route/security configuration blockers directly. CloudFront and Route 53 solve different layers.

Fast decision rule

Choose Reachability Analyzer for configured-path proof, VPC or Transit Gateway Flow Logs for flow evidence, Traffic Mirroring for packet-level analysis, Network Manager and CloudWatch for topology and operational metrics, and service logs when a managed service received the request. Always match the tool to the suspected failure layer before collecting more data.

Quiz

Continue with 3.3 Network Performance, Reliability, and Cost Optimization to turn troubleshooting evidence into performance and cost decisions.