AssociateOpen20 min
INC-1043 Lab 01: The Misplaced NAT Gateway
Outbound API calls from the private subnet time out after deploying the new VPC
AWS VPCNAT Gateway
The troubleshooting gym
Fix the broken network
Every lab ships as a single Terraform file that deploys a genuinely broken environment. You get the ticket, not the answer. Reproduce the failure, find the root cause, then check your reasoning against the debrief.
22 labs
AssociateFree account25 min
INC-1088 Lab 02: The Hardened Subnet That Broke Everything
Reporting service cannot reach the database after a NACL hardening change
NACL / Security GroupsAWS VPC
ProfessionalFree account30 min
INC-1142 Lab 03: The Spoke That Could Not Be Answered
Newly onboarded spoke VPC cannot reach shared services; the existing spoke works
Transit GatewayAWS VPC
SpecialtyFree account30 min
INC-1207 Lab 04: The Endpoint That Answered To Nobody
Application cannot reach the vendor API through its new PrivateLink endpoint
PrivateLinkNACL / Security GroupsAWS VPC
SpecialtyPro30 min
INC-1341 Lab 05: The Hostname That Existed In Only One VPC
Reporting service cannot resolve db.svc.internal after migration to its own VPC
Route 53 ResolverAWS VPC
ProfessionalPro30 min
INC-1388 Lab 06: The Load Balancer That Was Not There
Clients time out against the new internal load balancer while its target reports healthy
Load BalancingNACL / Security GroupsAWS VPC
SpecialtyPro35 min
INC-1402 Lab 07: The Tunnel That Was Up And Went Nowhere
New Site-to-Site VPN shows both endpoints healthy but carries no traffic
Site-to-Site VPNAWS VPC
AssociatePro20 min
INC-1455 Lab 08: The Subnet That Belonged To No Route Table
Instances in the new subnet never come online in Systems Manager
AWS VPC
SpecialtyPro35 min
INC-1478 Lab 09: The Reply That Went To The Wrong VPC
Team B cannot reach the shared directory service; team C can
AWS VPC
ProfessionalPro25 min
INC-1512 Lab 10: The Endpoint That Resolved To The Internet
Payments worker times out fetching its database credential on boot
PrivateLinkRoute 53 Resolver
ProfessionalPro30 min
INC-1533 Lab 11: The Egress That Worked Half The Time
Outbound API calls fail intermittently from the workload subnet
NACL / Security GroupsNAT Gateway
SpecialtyPro35 min
INC-1566 Lab 12: The Name That Resolved To Last Year
Payments reconciliation is writing to the decommissioned legacy host
Route 53 Resolver
SpecialtyPro30 min
INC-1601 Lab 13: The Attachment That Joined The Wrong Route Table
Audit finding: unsegmented VPC has a path into the regulated environment
Transit Gateway
ProfessionalPro25 min
INC-1638 Lab 14: The Health Check That Sent Binary
All targets unhealthy behind the internal NLB after enabling client IP visibility
Load Balancing
AssociatePro20 min
INC-1671 Lab 15: The Half Of The Internet That Was Missing
Partner API over IPv6 times out; unrelated services got slower the same day
AWS VPC
ProfessionalPro25 min
INC-1704 Lab 16: The Borrowed NAT Gateway
Application VPC has no outbound internet after moving to shared egress
AWS VPCNAT Gateway
SpecialtyPro40 min
INC-1738 Lab 17: The Appliance Mode That Was Enabled And Ignored
Cross-zone data transfer on the inspection VPC is roughly half of all inspected traffic
Transit Gateway
ProfessionalPro25 min
CHG-2041 Lab 18: The Deny Rule That May Not Be Read
Confirm whether subnet network ACLs still apply once client IP preservation is enabled
Global AcceleratorNACL / Security GroupsAWS VPC
ProfessionalPro45 min
INC-1772 Lab 19: The Firewall Rule That Only Guarded Itself
Plaintext HTTP from spoke VPCs still reaches the internet after the egress block was signed off
Network FirewallTransit Gateway
ProfessionalPro30 min
INC-1791 Lab 20: The Egress VPC That Routed Around Its Own NAT Gateway
All spoke VPCs lost internet access after cutover to the central egress VPC; egress VPC itself is fine
NAT GatewayTransit GatewayAWS VPC
AssociatePro25 min
INC-1806 Lab 21: The Hardening Change That Took The Site Down
Site returns 503 from the load balancer after the HTTPS redirect change; the web servers themselves are up
Load Balancing
AssociatePro20 min
INC-1823 Lab 22: The Security Group With Four Rules That Was Full
Cannot add an inbound rule to the web security group; API says the rule limit is reached but the group has four rules
NACL / Security GroupsAWS VPC