ANS-C01 Ephemeral ports Practice Question
A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer in the public subnets distributes traffic to EC2 instances in the private subnets. The security group for the EC2 instances allows inbound traffic from the ALB security group. Users report intermittent timeouts. What is the most likely cause?
⚠ Common exam trap
Candidates often overlook that network ACLs are stateless and must allow ephemeral ports for return traffic. A missing rule for high ports (1024-65535) causes intermittent failures, not a complete outage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network ACL for the private subnets is blocking inbound traffic from the ALB subnets.
Intermittent timeouts are often caused by network ACL rules that block ephemeral ports used for return traffic. The ALB initiates connections to EC2 instances on random ephemeral ports (1024-65535). If the private subnet's network ACL denies inbound traffic on these ports from the ALB subnets, connections will fail intermittently. In contrast, a missing inbound rule on the ALB security group would result in consistent failures, not intermittent ones.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group for the ALB does not allow inbound traffic from the internet.
Why it's wrong here
This would cause complete failure, not intermittent timeouts. The ALB security group must allow inbound from internet, but missing this rule blocks all traffic.
- ✗
The ALB is not associated with an internet gateway.
Why it's wrong here
The ALB does not need an internet gateway association; it uses an internet-facing scheme that routes through the VPC's internet gateway via route tables.
- ✓
The network ACL for the private subnets is blocking inbound traffic from the ALB subnets.
Why this is correct
Correct. Network ACLs are stateless and must allow both inbound and outbound ephemeral port traffic. A missing inbound rule for ephemeral ports from ALB subnets will cause intermittent timeouts as some connections succeed and others fail.
- ✗
Cross-zone load balancing is disabled on the ALB.
Why it's wrong here
Cross-zone load balancing being disabled would not cause timeouts; it would only cause uneven traffic distribution.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.