ANS-C01 Network Implementation Practice Question
A company has deployed a Network Load Balancer (NLB) in a VPC. The NLB is configured with a target group that points to EC2 instances in the same VPC. The network engineer notices that traffic from clients is not being forwarded to the targets. The NLB's security groups and network ACLs allow all traffic. What is the most likely cause?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that NLB health checks are the primary cause of traffic not being forwarded, but the real trap here is that candidates overlook the asymmetric routing issue where targets cannot send return traffic back through the NLB due to missing routes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EC2 instances are missing a route back to the NLB's subnet.
When an NLB forwards traffic to targets, the targets must send response traffic back to the clients. If the EC2 instances lack a route to the NLB's subnet (or the client's IP via the NLB), the return traffic will be dropped, causing the connection to fail. Since the NLB operates at layer 4 and preserves the client IP, the targets need a route back to the client, often via the NLB's private IP or the VPC's default gateway, depending on the architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group attached to the NLB is blocking traffic.
Why it's wrong here
NLBs do not have security groups; they are controlled by subnet ACLs.
- ✓
The EC2 instances are missing a route back to the NLB's subnet.
Why this is correct
Preserve client IP is enabled, so targets must send response back to NLB; if they have a default route to NAT gateway, return traffic goes to internet.
- ✗
The NLB health checks are failing, causing targets to be marked unhealthy.
Why it's wrong here
This would cause traffic not to be sent, but the question says traffic is not forwarded; health checks might be the symptom but not the most likely cause.
- ✗
Cross-zone load balancing is disabled on the NLB.
Why it's wrong here
Disabling cross-zone does not prevent traffic; it only restricts distribution.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.