Observability, Troubleshooting, and Cost/Performance
Observability questions ask you to choose the right telemetry and interpret it. The exam tests flow logs, metrics, tracing, reachability analysis, and the cost implications of network design.
Core rules
- Flow logs record metadata (source, destination, port, action, bytes), not packet payloads.
- Metrics show trends; logs show events; traces show request paths across services.
- Reachability analyzers test configuration paths without sending traffic.
- Latency is round-trip time; throughput is capacity. High latency with low throughput suggests windowing or loss, not insufficient bandwidth.
- Egress and NAT gateway processing incur charges; private endpoints can reduce egress but add endpoint-hour costs.
- Packet capture through traffic mirroring is for deep inspection and is expensive.
Worked example
Users report intermittent timeouts to an API. Flow logs show REJECTs on port 443 from the client CIDR. The security group lacks a rule for that CIDR. After adding it, large uploads still fail. A ping with the DF bit set and a 1472-byte payload fails, indicating an MTU black hole; lowering the path MTU or enabling MSS clamping fixes it.
Traps
- Enabling flow logs but never querying them.
- Confusing latency with bandwidth.
- Ignoring data-transfer and NAT processing costs.
- Overlooking longest-prefix match when multiple routes exist.