ANS-C01 Network Management and Operations Practice Question

A company has a VPC with a public subnet hosting a web server. The security group for the web server allows inbound HTTP (port 80) from 0.0.0.0/0. The network ACL for the public subnet allows inbound HTTP from 0.0.0.0/0. Users report that they cannot access the website. The engineer verifies that the web server is running and has a public IP. What is the most likely issue?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The network ACL outbound rule is blocking return traffic.

Even if inbound rules allow traffic, if the network ACL's outbound rule (stateless) does not allow return traffic (ephemeral ports), the connection will fail. Security groups are stateful and allow return traffic automatically.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The web server is listening on a different port.
Why it's wrong here
If the server were on a different port, the security group would block it.
✓
The network ACL outbound rule is blocking return traffic.
Why this is correct
Network ACLs are stateless, so return traffic on ephemeral ports must be explicitly allowed.
✗
The internet gateway is not attached to the VPC.
Why it's wrong here
If the IGW were missing, no traffic would reach the server at all.
✗
The security group outbound rule is blocking return traffic.
Why it's wrong here
Security groups are stateful; outbound rules do not affect established connections.

Visual reference

Go deeper

ANS-C01 Network Management and Operations Practice Question

Why each option matters

Option-by-option breakdown

Related to this question