DVA-C02 Troubleshooting and Optimization Practice Question
An application running on Amazon ECS Fargate is experiencing intermittent connection timeouts when calling an external API. The task has a public IP and a security group that allows outbound HTTPS. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume a public IP on the task guarantees internet access, overlooking that the subnet’s route table determines whether traffic can reach the internet, and a private subnet without a NAT gateway blocks all outbound internet traffic regardless of the task’s public IP assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The task is running in a private subnet without a NAT gateway.
ECS Fargate tasks running in a private subnet do not have direct internet access. Without a NAT gateway, outbound traffic to the external API is routed to the subnet’s route table, which lacks an internet gateway target, causing connection timeouts. The task’s public IP assignment is irrelevant in a private subnet, as the subnet itself has no route to the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ECS service is not configured to auto-assign public IP.
Why it's wrong here
Configuring an ECS service to auto-assign a public IP addresses a scenario where a task needs direct internet ingress/egress from a public subnet. However, if the task is launched in a private subnet, assigning a public IP is ineffective because private subnets are not directly routable to the internet. Instead, outbound internet access from a private subnet requires a NAT Gateway. Therefore, this configuration alone would not resolve outbound connectivity issues for a task in a private subnet.
- ✗
The task's security group does not allow inbound traffic.
Why it's wrong here
Security group inbound rules control traffic permitted *into* an ECS Fargate task. While critical for services that accept external connections, these rules do not impact the task's ability to initiate *outbound* connections to the internet. By default, security groups allow all outbound traffic, meaning a lack of inbound rules would not prevent the application from reaching external resources. Thus, misconfigured inbound rules are irrelevant to an outbound connectivity problem.
- ✗
The security group outbound rules are misconfigured.
Why it's wrong here
AWS security groups, by default, have an implicit rule that permits all outbound traffic (0.0.0.0/0 on all protocols and ports). For an application to experience outbound connectivity issues due to security group misconfiguration, this default rule would need to have been explicitly modified or overridden to restrict outbound access. Since the default is permissive, it is highly unlikely that misconfigured outbound rules are the root cause unless a specific restrictive rule was intentionally added.
- ✓
The task is running in a private subnet without a NAT gateway.
Why this is correct
ECS Fargate tasks deployed into a private subnet require a NAT Gateway to establish outbound connections to the internet. Private subnets are intentionally isolated from direct internet routing, meaning tasks within them cannot directly access external services or pull container images without an intermediary. A NAT Gateway, placed in a public subnet and configured with a route table entry for the private subnet, translates private IP addresses to its public IP, enabling secure and managed outbound internet access. This is the standard and necessary architecture for internet connectivity from private subnets.
Visual reference
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An application running on Amazon ECS with Fargate is unable to connect to the internet. The task definition does not have any network configuration specified. What is the MOST likely cause?
easy- A.The security group associated with the task does not allow outbound traffic.
- ✓ B.The task is not assigned a public IP address and is in a private subnet.
- C.The ECS service discovery is not configured.
- D.The VPC does not have an internet gateway attached.
Why B: Fargate tasks using the awsvpc network mode do not have public IP addresses by default unless explicitly assigned. If the task is placed in a private subnet, it needs a route to a NAT gateway to access the internet. Without a public IP and without a NAT gateway, the task cannot connect to the internet. Option A (security group not allowing outbound) is incorrect because security groups are stateful and allow outbound traffic by default; the issue is routing, not security groups. Option C (service discovery) is unrelated to internet access; it is for service-to-service DNS within the VPC. Option D (no internet gateway) is incorrect because even with an internet gateway, a private subnet instance still needs a NAT gateway; the internet gateway alone does not provide internet access to private subnet resources.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.