ANS-C01 Network Management and Operations Practice Question
A company has a VPC with an Application Load Balancer (ALB) in front of EC2 instances. The security group for the ALB allows inbound HTTP traffic from 0.0.0.0/0. The security group for the EC2 instances allows inbound traffic only from the ALB security group. However, the health checks are failing. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The target group is not configured with the correct health check path
The most likely cause of health check failures is an incorrect health check path configured in the target group. The security group configuration described in the stem should allow health check traffic because the EC2 security group explicitly allows inbound traffic from the ALB security group. However, if the target group's health check path does not match the actual endpoint on the EC2 instances (e.g., it expects a 200 response from a specific URL that is not available), the health checks will fail. Option B is incorrect because ALBs can be placed in private subnets without issue. Option C is incorrect because the stem states the EC2 security group allows inbound traffic from the ALB security group. Option D is incorrect because outbound rules on the ALB security group do not affect inbound health checks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The target group is not configured with the correct health check path
Why this is correct
Correct. An incorrect health check path will cause the ALB to receive non-200 responses, marking instances unhealthy.
- ✗
The ALB is in a private subnet
Why it's wrong here
Incorrect. ALBs can be placed in private subnets; they still communicate with targets via private IPs.
- ✗
The EC2 security group does not allow inbound traffic from the ALB security group
Why it's wrong here
Incorrect. The stem explicitly states the EC2 security group allows inbound traffic from the ALB security group, so this is not the cause.
- ✗
The ALB security group does not allow outbound traffic
Why it's wrong here
Incorrect. The ALB security group outbound rules are not relevant for health checks; health checks are initiated by the ALB, and the target security group controls inbound access.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.