Study SOA-C03 Network Logs and Connectivity Troubleshooting: key concepts, common traps, and exam decision cues.
This lesson covers SOA-C03 Task 5.3: troubleshooting network connectivity issues. AWS is testing whether you can prove which hop is broken instead of staring at every network service at once. Strong answers identify the intended path first, then choose the evidence source that can confirm or reject that path, then separate route problems from filtering problems and cache behavior from origin failures.
Flow log: Record of accepted or rejected traffic for a VPC, subnet, or network interface.
Cache miss: Request that CloudFront could not serve from cache and therefore forwarded to the origin.
Hybrid path: Connectivity path that crosses between AWS and on-premises or another private environment.
AWS wants you to separate:
| If the symptom is mainly about… | Strongest first evidence lane | Why |
|---|---|---|
| accepted or rejected traffic at the network boundary | VPC Flow Logs | They show whether traffic was allowed or rejected at the observed point. |
| load balancer request path behavior | ELB access logs | These show request handling at the load balancer layer. |
| WAF inspection decisions | WAF logs | The problem may be policy enforcement, not routing. |
| CloudFront object handling or edge behavior | CloudFront logs and cache behavior settings | This is the edge-distribution lane. |
| whether the path should exist at all | route tables, gateways, endpoints, and hybrid design | If the route is wrong, packet filtering is not the first issue. |
If you skip step 2, you often debug security groups when the traffic was never on the right route in the first place.
| Question | Cache problem | Origin problem |
|---|---|---|
| Main symptom | stale object, wrong path pattern, unexpected edge behavior | CloudFront cannot fetch or gets bad responses from the backend |
| Strongest first checks | TTL, invalidation, cache behavior, object path rules | origin health, origin path, permissions, backend response |
| Common trap | assuming every cache miss is an outage | assuming the edge is wrong when the origin itself is failing |
When a stem mixes VPN, Direct Connect, PrivateLink, VPC endpoints, NAT, or transit-style routing, the strongest first move is often to re-establish the intended connectivity model:
Only after that should you focus on packet filtering evidence.
| Trap | Better thinking |
|---|---|
| “Networking issue means check security groups first.” | First prove the route and connectivity model are correct. |
| “A CloudFront cache miss means the origin is down.” | A miss only means the object was not served from cache. |
| “Accepted traffic in flow logs proves the application path is correct.” | It proves the observed boundary accepted traffic, not that the whole intended path is right. |
| “Hybrid connectivity is just VPC troubleshooting with different labels.” | Hybrid paths add different gateways, route exchanges, and private-path assumptions. |
A workload in a private subnet cannot reach an intended target over a private connectivity path. Flow logs show traffic accepted on one interface, but the application is still unreachable. The architecture is supposed to use a specific private path rather than ordinary public egress.
Which troubleshooting question is strongest first?
Correct answer: 1
Why: Accepted traffic at one observed point does not prove the end-to-end private path is correct. The strongest next step is to verify the intended route and connectivity model.