ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with multiple subnets. The network ACL for a subnet is configured to deny all inbound traffic. A security group attached to an EC2 instance in that subnet allows SSH from a specific IP range. Will SSH traffic from that IP range reach the instance?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No, because the network ACL denies all inbound traffic.
Network ACLs are stateless and deny all inbound traffic, so even though the security group allows SSH, the network ACL will block the traffic before it reaches the instance. Option A is wrong because security groups are stateful but are evaluated after network ACLs. Option C is wrong because the network ACL operates at the subnet level. Option D is wrong because the order does not matter for stateless ACLs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Yes, because the security group allows SSH.
Why it's wrong here
The security group is evaluated after the network ACL; the network ACL blocks the traffic first.
- ✓
No, because the network ACL denies all inbound traffic.
Why this is correct
The network ACL is stateless and denies all inbound traffic, so the traffic is blocked.
- ✗
Yes, because the security group overrides the network ACL.
Why it's wrong here
Security groups do not override network ACLs; both must allow traffic.
- ✗
It depends on the rule number order in the network ACL.
Why it's wrong here
If all inbound traffic is denied, the rule number does not matter.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.