ANS-C01 Network Implementation Practice Question
A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is internet-facing and uses a public subnet. The EC2 instances are in private subnets. The application needs to be accessible from the internet. The security group for the ALB allows inbound HTTP and HTTPS from 0.0.0.0/0. The security group for the EC2 instances allows inbound traffic from the ALB's security group. The route tables for the private subnets have a default route to a NAT gateway. Users report that they cannot access the application. The ALB target group shows the instances as unhealthy. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port.
When using an Application Load Balancer (ALB), the target group health checks originate from the ALB's nodes. The security group for the EC2 instances must allow inbound traffic from the ALB's security group on the health check port, typically port 80 or 443. If this rule is missing, the health checks fail and the instances are marked unhealthy, preventing traffic from being forwarded. Option B is wrong because the ALB is described as internet-facing and deployed in a public subnet. Option C is wrong because an internet gateway route is attached to the public subnet where the ALB resides, not to the ALB itself. Option D is wrong because the NAT gateway handles outbound traffic from the private subnets, not inbound health check traffic from the ALB.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The security group for the EC2 instances does not allow inbound traffic from the ALB's security group on the health check port.
Why this is correct
Health checks fail if security group blocks traffic.
- ✗
The ALB is deployed in a private subnet instead of a public subnet.
Why it's wrong here
Stem says ALB is in public subnet.
- ✗
The ALB does not have an associated internet gateway route.
Why it's wrong here
ALB uses its own internet-facing nature; no route needed.
- ✗
The NAT gateway is not correctly routing traffic from the instances to the internet.
Why it's wrong here
Not relevant for inbound traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.