An application load balancer returns sporadic 503 responses right after each release. The on-call engineer suspects a security group or network ACL is blocking responses from the instances back to the balancer. Which tool should the engineer run first to check that path?
Show answer and explanation
Answer: B
Reachability Analyzer evaluates the network configuration between two network interfaces and reports whether a path exists. When a path is blocked, it names the component responsible, such as a security group or network ACL rule. Running it from a load balancer node interface to a target interface checks the forward path, and reversing source and destination checks the return path. The other three tools do not analyze packet paths.
Why the other options are wrong
- A. A conformance pack checks resources against compliance rules, such as encryption or tagging settings. It does not trace whether packets can travel between a balancer node and a target.
- C. Storage Lens reports object storage usage and activity across S3 buckets. It has no view of security groups, network ACLs, or connectivity between load balancer nodes and instances.
- D. Compute Optimizer recommends instance types and sizes based on utilization. It does not diagnose 503 errors or check whether network rules allow return traffic.