ANS-C01 Network Design Practice Question
A company has a VPC with a CIDR block of 10.0.0.0/16. It has two subnets: subnet A (10.0.1.0/24) and subnet B (10.0.2.0/24). Both subnets have a route to an Internet Gateway. An EC2 instance in subnet A has a security group that allows inbound HTTP from 0.0.0.0/0. The instance's network ACL allows inbound HTTP from 0.0.0.0/0. Users report they cannot access the web server. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume that allowing traffic in both the security group and network ACL is sufficient, overlooking the fundamental requirement of a public IP address for internet-facing communication via an Internet Gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The instance does not have a public IP address
The most likely cause is that the EC2 instance does not have a public IP address. Even though the security group and network ACL allow inbound HTTP from 0.0.0.0/0, and the subnet has a route to an Internet Gateway (IGW), the instance must have a public IPv4 address (or an Elastic IP) for the IGW to translate its private IP to a public IP and route traffic from the internet. Without a public IP, the IGW cannot forward inbound traffic to the instance, making it unreachable from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The instance does not have a public IP address
Why this is correct
Without a public IP, the instance is not reachable from the internet.
- ✗
The network ACL inbound rule is incorrectly configured
Why it's wrong here
The network ACL allows inbound HTTP.
- ✗
The security group is not associated with the instance
Why it's wrong here
The scenario states the security group allows inbound HTTP.
- ✗
The route table does not have a route to the Internet Gateway
Why it's wrong here
The scenario states both subnets have a route to the Internet Gateway.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.