ANS-C01 Network Management and Operations Practice Question
A company has a production VPC with a public and private subnet across two Availability Zones. The public subnet hosts a Network Load Balancer (NLB) that distributes traffic to EC2 instances in the private subnet. The application experiences periodic failures where the NLB marks all targets as unhealthy for about 2 minutes, then they recover. The health checks are HTTP on port 80 with a 5-second interval, 2 consecutive successes to be healthy, and 2 consecutive failures to be unhealthy. The target group health check timeout is 5 seconds. The EC2 instances are behind an Auto Scaling group with a minimum of 2 instances per AZ. CPU utilization on the instances is stable at 40%. The NLB's CloudWatch metrics show HealthyHostCount drops to zero suddenly. The network engineer suspects a network issue. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The health check timeout is equal to the interval, causing timeouts under transient network delays.
The health check timeout equals the interval (both 5 seconds). Under transient network delays, a health check response can be delayed beyond the timeout, causing the NLB to count a failure. With 2 consecutive failures required to mark unhealthy, a brief period of latency can cause all targets to be marked unhealthy for about 2 minutes (2 intervals × 5 seconds = 10 seconds of failures, but the recovery requires 2 consecutive successes, leading to the observed ~2-minute duration due to repeated timeouts). The instances are not overloaded (CPU 40%), and security groups and route tables are configured correctly since normal operation resumes. This configuration violates the best practice of setting the timeout lower than the interval to allow for retries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group for the private subnet is blocking inbound traffic from the NLB.
Why it's wrong here
If blocked, health checks would always fail, not periodically.
- ✓
The health check timeout is equal to the interval, causing timeouts under transient network delays.
Why this is correct
If timeout equals interval, any delay in response results in consecutive failures, marking the instance unhealthy. Increasing the interval or decreasing the timeout would help.
- ✗
The NLB's cross-zone load balancing is disabled, causing all traffic to go to one AZ.
Why it's wrong here
This would cause uneven load, but not sudden simultaneous failures across both AZs.
- ✗
The route tables for the private subnets are missing a route to the NLB's subnet.
Why it's wrong here
Health checks are initiated by the NLB to the instances; return traffic is handled by the instances' route tables, which should have a default route via NAT or IGW. Missing routes would cause consistent failures.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.