DVA-C02 Troubleshooting and Optimization Practice Question
A developer is troubleshooting an EC2 instance that cannot connect to the internet. The instance has a public IP address and is in a public subnet with a route to an internet gateway. The security group allows all outbound traffic. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network ACL's outbound rules are blocking traffic.
Network ACLs are stateless and block traffic unless explicitly allowed. The security group allows all outbound traffic, but if the network ACL's outbound rules are too restrictive, traffic can be blocked. Option A is wrong because the subnet has a route to an internet gateway. Option B is wrong because the security group allows all outbound traffic. Option D is wrong because the instance has a public IP address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The subnet's route table does not have a route to an internet gateway.
Why it's wrong here
The scenario explicitly states the instance is in a public subnet with a route to an internet gateway already configured, so a missing route table entry for the internet gateway is already ruled out by the given facts and cannot be the cause of the connectivity failure.
- ✗
The security group's outbound rules are too restrictive.
Why it's wrong here
The scenario states the security group allows all outbound traffic, and because security groups are stateful, return traffic for any connection the instance initiates is automatically permitted back in regardless of inbound rules, so an overly restrictive security group is explicitly excluded as the cause by the given information.
- ✓
The network ACL's outbound rules are blocking traffic.
Why this is correct
Unlike security groups, network ACLs are stateless, meaning outbound and return inbound traffic must each be explicitly permitted by separate rule evaluations; if the outbound NACL rules block traffic to the internet, or the inbound rules fail to allow the ephemeral port range needed for return traffic, connectivity will fail even with a correctly configured route table and permissive security group.
- ✗
The instance does not have a public IP address.
Why it's wrong here
The scenario explicitly states the instance has a public IP address assigned, which is a prerequisite the question has already confirmed is in place, so a missing public IP cannot be the explanation for the described internet connectivity failure.
Visual reference
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 1,135-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.