ANS-C01 Network Implementation Practice Question
A company has a VPC with a CIDR of 172.16.0.0/16. The VPC has two subnets: subnet A (172.16.1.0/24) and subnet B (172.16.2.0/24). The company launches an EC2 instance in subnet A with a private IP of 172.16.1.10 and a public IP. The instance's security group allows inbound SSH from 0.0.0.0/0. The subnet A's route table has a route to an internet gateway (IGW) for 0.0.0.0/0. The network engineer can SSH into the instance from the internet. The company then attaches a second network interface (eth1) to the instance with an IP from subnet B (172.16.2.20). The engineer wants to use this interface for additional management traffic. After attaching, the engineer can no longer SSH into the instance via the original public IP. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The operating system's routing table now uses eth1 as the default gateway, causing asymmetric routing.
When a second ENI (eth1) is attached to an EC2 instance, the operating system may reassign the default gateway route to the new interface, especially if the new interface receives a default route via DHCP. This causes traffic from the instance to egress via eth1 instead of eth0, while inbound traffic still arrives via the original public IP on eth0. This asymmetric routing breaks the SSH session because the response packets are sent out through eth1, which is in a different subnet and does not have the same public IP, so they are dropped. Option A correctly identifies this issue. Option D is incorrect because the IGW is attached to the VPC, not to individual subnets. Options B and C are not the most likely cause given the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The operating system's routing table now uses eth1 as the default gateway, causing asymmetric routing.
Why this is correct
Asymmetric routing can cause connection issues.
- ✗
The route table for subnet B does not have a route to the IGW.
Why it's wrong here
eth1 is in subnet B, but the issue is with inbound SSH via original IP.
- ✗
The security group for eth1 blocks inbound SSH.
Why it's wrong here
Security group for eth1 is separate but can be updated.
- ✗
The internet gateway is not attached to subnet B.
Why it's wrong here
IGW is attached to VPC, not subnet.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.