ANS-C01 Network Design Practice Question
A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application experiences intermittent timeouts during peak hours. The network team suspects that the security group or network ACL is misconfigured. They enable VPC Flow Logs and notice that outbound traffic from the ALB to the EC2 instances on port 8080 shows 'ACCEPT' records, but the ALB returns 504 errors. The ALB health check is configured to hit the EC2 instances on port 8080/health. What is the most likely cause of the 504 errors?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ALB idle timeout is set too low, and the application takes longer to respond.
The ALB idle timeout is set too low. When the application takes longer than the idle timeout to respond, the ALB terminates the connection and returns a 504 error. Flow logs show ACCEPT for traffic from ALB to EC2 on port 8080, indicating no network ACL or security group blocking. Option A is incorrect because a blocking NACL would show REJECT records. Option B is incorrect because security groups are stateful; outbound rules on the EC2 instance are not needed for returning traffic to the ALB. Option C is incorrect because a misconfigured health check path would cause the ALB to mark targets as unhealthy, leading to 503 errors rather than intermittent 504s.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The network ACL for the private subnet is blocking inbound traffic from the ALB.
Why it's wrong here
Flow logs show ACCEPT, so no blocking.
- ✗
The security group for the EC2 instances is missing an outbound rule to allow traffic from the ALB.
Why it's wrong here
Security groups are stateful; outbound is automatically allowed.
- ✗
The health check path is incorrectly configured, causing the ALB to mark all targets as unhealthy.
Why it's wrong here
Intermittent errors suggest not all targets are unhealthy.
- ✓
The ALB idle timeout is set too low, and the application takes longer to respond.
Why this is correct
ALB idle timeout default is 60 seconds; if app response exceeds that, 504 occurs.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.