ANS-C01 Network Implementation Practice Question
A company has deployed a web application behind an Application Load Balancer (ALB) in a VPC with public and private subnets. The ALB is in public subnets, and the web servers are in private subnets. Clients report intermittent connection errors. Investigation shows that the ALB is marking targets as unhealthy. What is the MOST likely cause?
⚠ Common exam trap
The trap here is that candidates often overlook that health checks must target private IPs within the VPC, not public IPs, and mistakenly focus on security group or ACL rules instead of the health check configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The health check is configured to use the public IP address of the targets, but the targets are in private subnets without public IPs.
When health checks are configured to use the public IP address of targets, the ALB attempts to reach the targets via the internet. Since the web servers are in private subnets without public IPs, the health check traffic cannot be routed to them, causing the ALB to mark them as unhealthy. Health checks must target private IP addresses within the VPC for instances in private subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The network ACL for the private subnets is blocking inbound traffic from the ALB.
Why it's wrong here
Network ACLs are stateless and must allow both inbound and outbound; but the more likely issue is health check configuration.
- ✗
The security group for the web servers does not allow inbound traffic from the internet.
Why it's wrong here
Traffic from the ALB originates from its private IPs within the VPC, not directly from the internet.
- ✗
The ALB is deployed in private subnets and cannot reach the internet.
Why it's wrong here
The scenario states ALB is in public subnets.
- ✓
The health check is configured to use the public IP address of the targets, but the targets are in private subnets without public IPs.
Why this is correct
Health checks must target the private IP of the instances; using public IPs will fail.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.