The answer is B: the ALB health check is configured to use HTTPS but the target only listens on HTTP. This mismatch causes the health check to time out at the application layer, even though the TCP handshake succeeds—which is why the logs show established TCP connections but HTTP requests failing. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your ability to distinguish between network-layer reachability (NACLs, security groups, routing) and application-layer protocol mismatches, a common trap when troubleshooting ALB health checks failing due to NACL configurations that appear correct. The key insight is that a 503 error with successful TCP connections points to a layer‑7 issue, not a network ACL problem. Memory tip: “TCP works, HTTP fails? Check the protocol, not the packet filter.”
ANS-C01 Network Implementation Practice Question
This ANS-C01 practice question tests your understanding of network implementation. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has a VPC with CIDR 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An Application Load Balancer (ALB) is deployed in the public subnet, and EC2 instances are in the private subnet. The ALB has a target group pointing to the EC2 instances. The security group for the EC2 instances allows traffic from the ALB's security group on port 80. The network ACL for the private subnet allows inbound traffic on port 80 from the public subnet CIDR (10.0.1.0/24) and allows outbound ephemeral ports. However, the ALB health checks are failing with 503 errors. The network engineer checks the ALB logs and sees that TCP connections are established but HTTP requests are timing out. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ALB health check is configured to use HTTPS but the target only listens on HTTP.
Option D is correct. The network ACL for the private subnet only allows inbound traffic from the public subnet CIDR (10.0.1.0/24). However, the ALB sends health checks from its private IP addresses, which are in the public subnet CIDR, so that should be fine. But the real issue is that the ALB also sends traffic to the targets using its own IP addresses, which are in the public subnet CIDR, so inbound is allowed. However, the outbound rule for the private subnet's network ACL must allow outbound traffic from the targets back to the ALB. The network ACL allows outbound ephemeral ports (1024-65535), but the ALB health check response uses the source port of the ALB (which is ephemeral) and the destination port on the target is 80. The response from the target goes back to the ALB's IP and port. The outbound rule in the network ACL should allow traffic to the ALB's subnet (10.0.1.0/24) on ephemeral ports. But the question says the network ACL allows outbound ephemeral ports without specifying destination. Actually, the outbound rule allows all ephemeral ports to anywhere? It says 'allows outbound ephemeral ports' - typically that means outbound to 0.0.0.0/0 on ephemeral ports. That should be fine. Wait, the issue might be that the network ACL is stateless and the outbound rule must allow the return traffic. The health check request comes from the ALB to the target on port 80. The target responds to the ALB's IP and source port. The outbound rule must allow traffic from the target to the ALB's IP on the ALB's source port (which is ephemeral). If the outbound rule allows all outbound ephemeral ports to 0.0.0.0/0, it should work. So why is it failing? Perhaps the ALB is using a different source IP? Actually, ALB health checks can originate from the ALB's private IP addresses. The network ACL for the private subnet has an inbound rule allowing port 80 from 10.0.1.0/24. That's correct. The outbound rule allows ephemeral ports to 0.0.0.0/0. That should allow the response. But maybe the outbound rule is too restrictive? Alternatively, the security group for the EC2 instances might not allow the response? But security groups are stateful, so if inbound is allowed, outbound is automatically allowed. So security group is fine. The most likely cause is that the network ACL inbound rule only allows from the public subnet CIDR, but the ALB might be using a different IP? No. Another possibility: the health check is sent from the ALB's nodes which are in the public subnet, but the public subnet CIDR is 10.0.1.0/24, so that's fine. Option D says 'The network ACL for the private subnet does not allow inbound traffic from the ALB's security group.' That is incorrect because network ACLs cannot reference security groups. So the correct answer is actually that the network ACL inbound rule should allow from the ALB's security group? No. Let's re-evaluate. The most common issue is that the network ACL is stateless and the outbound rule must allow the response. But the question says the outbound rule allows ephemeral ports. That should be fine. Perhaps the health check is using HTTPS but only port 80 is allowed? The question says port 80. Option B says 'The ALB health check is configured to use HTTPS but the target only listens on HTTP.' That could cause a timeout. But the question says the TCP connection is established, so the port is open. However, if the health check expects a 200 OK and the target returns something else, it could cause a 503. Option A says 'The security group for the ALB does not allow outbound traffic to the targets.' But security groups are stateful, so if inbound is allowed, outbound is allowed. Option C says 'The route table for the private subnet does not have a route to the ALB's subnet.' That would cause no connectivity at all. Actually, the most likely cause is that the health check is using a different port or protocol. But given the options, Option D is the trick: network ACLs cannot reference security groups, so that statement is false, making it a distractor. The correct answer is not listed? Wait, the question is a PBQ with 4 options. Let's list them: A: The security group for the ALB does not allow outbound traffic to the targets. B: The ALB health check is configured to use HTTPS but the target only listens on HTTP. C: The route table for the private subnet does not have a route to the ALB's subnet. D: The network ACL for the private subnet does not allow inbound traffic from the ALB's security group. Option D is impossible because network ACLs don't support security groups. So D is wrong. Option A is unlikely because security groups are stateful. Option C would cause complete failure, not just health check. Option B is plausible: if health check expects HTTPS but target only has HTTP, the health check will get a timeout or non-200 response, causing 503. So the correct answer is B.
Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The network ACL for the private subnet does not allow inbound traffic from the ALB's security group.
Why it's wrong here
Network ACLs cannot reference security groups; they use CIDR blocks.
✗
The security group for the ALB does not allow outbound traffic to the targets.
Why it's wrong here
Security groups are stateful; inbound rule allowing traffic from ALB automatically allows outbound response.
✓
The ALB health check is configured to use HTTPS but the target only listens on HTTP.
Why this is correct
This would cause the health check to fail with a timeout or non-200 response, resulting in 503.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
The route table for the private subnet does not have a route to the ALB's subnet.
Why it's wrong here
This would cause complete lack of connectivity, not just health check failures.
Common exam traps
Common exam trap: usable hosts are not the same as total addresses
Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.
Detailed technical explanation
How to think about this question
Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.
KKey Concepts to Remember
CIDR notation defines the prefix length.
Block size helps identify subnet boundaries.
Network and broadcast addresses are not usable hosts in normal IPv4 subnets.
The required host count determines the smallest suitable subnet.
TExam Day Tips
→Write the block size before choosing the subnet.
→Check whether the question asks for hosts, subnets or a specific address range.
→Do not confuse /24, /25, /26 and /27 host counts.
Key takeaway
Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Network Implementation — This question tests Network Implementation — CIDR notation defines the prefix length..
What is the correct answer to this question?
The correct answer is: The ALB health check is configured to use HTTPS but the target only listens on HTTP. — Option D is correct. The network ACL for the private subnet only allows inbound traffic from the public subnet CIDR (10.0.1.0/24). However, the ALB sends health checks from its private IP addresses, which are in the public subnet CIDR, so that should be fine. But the real issue is that the ALB also sends traffic to the targets using its own IP addresses, which are in the public subnet CIDR, so inbound is allowed. However, the outbound rule for the private subnet's network ACL must allow outbound traffic from the targets back to the ALB. The network ACL allows outbound ephemeral ports (1024-65535), but the ALB health check response uses the source port of the ALB (which is ephemeral) and the destination port on the target is 80. The response from the target goes back to the ALB's IP and port. The outbound rule in the network ACL should allow traffic to the ALB's subnet (10.0.1.0/24) on ephemeral ports. But the question says the network ACL allows outbound ephemeral ports without specifying destination. Actually, the outbound rule allows all ephemeral ports to anywhere? It says 'allows outbound ephemeral ports' - typically that means outbound to 0.0.0.0/0 on ephemeral ports. That should be fine. Wait, the issue might be that the network ACL is stateless and the outbound rule must allow the return traffic. The health check request comes from the ALB to the target on port 80. The target responds to the ALB's IP and source port. The outbound rule must allow traffic from the target to the ALB's IP on the ALB's source port (which is ephemeral). If the outbound rule allows all outbound ephemeral ports to 0.0.0.0/0, it should work. So why is it failing? Perhaps the ALB is using a different source IP? Actually, ALB health checks can originate from the ALB's private IP addresses. The network ACL for the private subnet has an inbound rule allowing port 80 from 10.0.1.0/24. That's correct. The outbound rule allows ephemeral ports to 0.0.0.0/0. That should allow the response. But maybe the outbound rule is too restrictive? Alternatively, the security group for the EC2 instances might not allow the response? But security groups are stateful, so if inbound is allowed, outbound is automatically allowed. So security group is fine. The most likely cause is that the network ACL inbound rule only allows from the public subnet CIDR, but the ALB might be using a different IP? No. Another possibility: the health check is sent from the ALB's nodes which are in the public subnet, but the public subnet CIDR is 10.0.1.0/24, so that's fine. Option D says 'The network ACL for the private subnet does not allow inbound traffic from the ALB's security group.' That is incorrect because network ACLs cannot reference security groups. So the correct answer is actually that the network ACL inbound rule should allow from the ALB's security group? No. Let's re-evaluate. The most common issue is that the network ACL is stateless and the outbound rule must allow the response. But the question says the outbound rule allows ephemeral ports. That should be fine. Perhaps the health check is using HTTPS but only port 80 is allowed? The question says port 80. Option B says 'The ALB health check is configured to use HTTPS but the target only listens on HTTP.' That could cause a timeout. But the question says the TCP connection is established, so the port is open. However, if the health check expects a 200 OK and the target returns something else, it could cause a 503. Option A says 'The security group for the ALB does not allow outbound traffic to the targets.' But security groups are stateful, so if inbound is allowed, outbound is allowed. Option C says 'The route table for the private subnet does not have a route to the ALB's subnet.' That would cause no connectivity at all. Actually, the most likely cause is that the health check is using a different port or protocol. But given the options, Option D is the trick: network ACLs cannot reference security groups, so that statement is false, making it a distractor. The correct answer is not listed? Wait, the question is a PBQ with 4 options. Let's list them: A: The security group for the ALB does not allow outbound traffic to the targets. B: The ALB health check is configured to use HTTPS but the target only listens on HTTP. C: The route table for the private subnet does not have a route to the ALB's subnet. D: The network ACL for the private subnet does not allow inbound traffic from the ALB's security group. Option D is impossible because network ACLs don't support security groups. So D is wrong. Option A is unlikely because security groups are stateful. Option C would cause complete failure, not just health check. Option B is plausible: if health check expects HTTPS but target only has HTTP, the health check will get a timeout or non-200 response, causing 503. So the correct answer is B.
What should I do if I get this ANS-C01 question wrong?
Review block sizes, usable host formulas (2^n − 2), and how to find network and broadcast addresses for /24 through /30. Then practise related ANS-C01 subnetting questions on CIDR, address ranges, and subnet selection.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
CIDR notation defines the prefix length.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.