ANS-C01 Network Design Practice Question
A company has a VPC with public and private subnets in three Availability Zones. An internet-facing Network Load Balancer (NLB) is deployed in the public subnets, and a fleet of EC2 instances is in the private subnets. The application logs show intermittent connection timeouts. The security group for the EC2 instances allows traffic from the NLB's security group. What is the MOST likely cause?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that an NLB's security group can be used as a source in backend instance security groups, similar to an ALB, but the NLB's preserve_client_ip feature breaks that assumption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EC2 instances' security group allows traffic from the NLB's security group, but the NLB preserves client IP, so the security group must allow client IPs directly.
When an NLB is configured with `preserve_client_ip` enabled (the default for internet-facing NLBs), the source IP of incoming packets is the actual client IP, not the NLB's private IP. Therefore, the EC2 instances' security group must allow traffic from the client IPs, not from the NLB's security group. Since the security group only allows traffic from the NLB's security group, packets from client IPs are dropped, causing intermittent connection timeouts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-zone load balancing is disabled on the NLB.
Why it's wrong here
Disabled cross-zone can cause uneven distribution but not timeouts if instances in all AZs.
- ✓
The EC2 instances' security group allows traffic from the NLB's security group, but the NLB preserves client IP, so the security group must allow client IPs directly.
Why this is correct
NLB preserves source IP; security group references to NLB's security group only work for traffic that originates from NLB's private IPs, but NLB sends client IPs.
- ✗
The NLB's security group is not allowing traffic from the EC2 instances.
Why it's wrong here
NLB does not have a security group; it uses security groups for targets.
- ✗
The network ACLs in the private subnets are blocking return traffic.
Why it's wrong here
Network ACLs are stateless and need outbound ephemeral ports open; this could be a cause but less likely than security group.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.