ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to use a proxy server running on an EC2 instance in the public subnet. The security group for the proxy server must allow inbound HTTP/HTTPS from the instance in the private subnet. The security group for the private instance must allow outbound HTTP/HTTPS to the proxy server. However, the private instance cannot connect to the proxy. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table for the private subnet has a default route pointing to a NAT gateway instead of the proxy server.
The route table for the private subnet likely has a default route pointing to a NAT gateway or internet gateway, causing traffic to bypass the proxy server. Even though security groups are configured correctly, routing decisions are made first. Traffic from the private instance to the proxy server would be directed to the default gateway (NAT/internet gateway) instead of the proxy's IP address. Option A is incorrect: the security group for the private instance does allow outbound HTTP/HTTPS to the proxy. Option B is incorrect: network ACLs are stateless and must allow both inbound and outbound; but if they blocked inbound from the proxy, that would affect return traffic, not the initial connection. Option D is incorrect: the proxy's security group is configured to allow inbound from the private instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group for the private instance does not allow outbound traffic to the proxy server.
Why it's wrong here
The question states that the security group allows outbound to the proxy.
- ✗
The network ACL for the private subnet blocks inbound traffic from the proxy.
Why it's wrong here
The network ACL must allow inbound traffic from the proxy for the return traffic, but the issue is outbound from the private instance.
- ✓
The route table for the private subnet has a default route pointing to a NAT gateway instead of the proxy server.
Why this is correct
If the default route points to a NAT gateway, traffic to the internet goes through the NAT gateway instead of the proxy.
- ✗
The security group for the proxy server does not allow inbound traffic from the private instance's security group.
Why it's wrong here
The question states that the security group is configured to allow inbound from the private instance.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.