DVA-C02 Troubleshooting and Optimization Practice Question
Network Topology
Refer to the exhibit. A developer runs the AWS CLI command for an EC2 instance. The instance is in the 'running' state, but the application hosted on it is not reachable. What should the developer check first?
⚠ Common exam trap
Candidates often confuse the instance state ('running') with network accessibility. An instance can be fully operational and healthy, but still completely unreachable from the internet if the security group rules or network ACLs are misconfigured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the security group rules for inbound traffic.
When an EC2 instance is in the 'running' state but the application is unreachable, the most common initial cause is that the Security Group associated with the instance does not allow inbound traffic on the application's port (e.g., port 80 or 443). Security groups act as stateful firewalls at the instance level, and by default, they block all inbound traffic unless explicitly allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the security group rules for inbound traffic.
Why this is correct
Security groups act as a virtual stateful firewall for EC2 instances, controlling both inbound and outbound traffic. If the security group associated with the EC2 instance does not have an inbound rule explicitly allowing traffic on the required port (e.g., HTTP on port 80, SSH on port 22) from the source IP address range of the client, the connection will be blocked. This typically results in a "Connection refused" or timeout error, even if the instance is running and healthy, making it the most common cause of network connectivity issues.
- ✗
Check the ELB health check settings.
Why it's wrong here
Elastic Load Balancer (ELB) health checks are mechanisms used by a load balancer to determine the availability and health of registered target instances. The question implies a direct attempt to connect to an EC2 instance, not through an ELB, as there is no mention of a load balancer in the scenario or the AWS CLI command context. Therefore, ELB health check settings are irrelevant to troubleshooting a direct connection failure to an individual EC2 instance.
- ✗
Check the instance status checks in the EC2 console.
Why it's wrong here
EC2 instance status checks monitor the health of the underlying host hardware (system status checks) and the operating system/applications running on the instance (instance status checks). While critical for overall instance health, these checks indicate if the instance is operational, not if its network configuration (like security group rules or OS-level firewalls) permits inbound connections on specific ports. An instance can pass all status checks but still be inaccessible due to network security rules blocking external access.
- ✗
Verify the instance ID is correct.
Why it's wrong here
The scenario states that the `aws cli command f` was run, and it implies that the command successfully returned data about the specified instance. If the AWS CLI command successfully queried information about the instance using its ID, it confirms that the instance ID is valid and refers to an existing, identifiable resource within the AWS account. The problem lies in the *accessibility* of the instance over the network, not its identification or existence.
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.