A healthcare company must prove that production databases accept traffic only from approved application tiers and has hundreds of sprawling security groups. Auditors require evidence of unintended reachable paths before migration. Which control should the engineer use to identify unnecessary network access with reachable-path evidence?

Network Access Analyzer uses automated reasoning against VPC configurations including security groups, route tables, NACLs, and gateways to identify reachable network paths and flag findings that fall outside a defined intended scope, providing auditor-ready evidence of unnecessary access without deploying agents. AWS Verified Access provides zero-trust authenticated access to applications but does not analyze existing VPC reachability or audit sprawling security groups. Amazon Inspector network reachability focuses on EC2 instance reachability findings and software vulnerability assessment rather than full VPC path analysis against custom scopes. Manually reviewing VPC Flow Logs samples is reactive, incomplete, and labor intensive and cannot prove absence of unintended paths across hundreds of groups. For the exam remember Network Access Analyzer proves configured reachability while Flow Logs show observed traffic, and in practice define narrow scopes per tier and re-run after remediation.