ANS-C01 Network Management and Operations Practice Question
A company uses AWS CloudFormation to deploy a multi-tier application. The template includes a VPC, public and private subnets, security groups, and an Application Load Balancer. The network team wants to ensure that the ALB can only accept traffic from a specific set of IP addresses. They add a security group rule that allows inbound traffic on port 443 from the allowed IP CIDR. However, after deployment, the ALB is not responding to requests from the allowed IPs. The team checks the security group and confirms the rule exists. They also verify that the ALB is in the public subnet and has a public DNS name. What is the MOST likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The public subnet does not have a route to an internet gateway.
The most likely cause is that the public subnet does not have a route to an internet gateway. For an internet-facing ALB to receive traffic from the internet, the subnets where the ALB is deployed must have a default route (0.0.0.0/0) pointing to an internet gateway. Without this route, even if the security group allows the traffic, the ALB cannot be reached because the subnet is not routable from the internet. Option A is incorrect because security groups are stateful and automatically allow return traffic, so that would not block responses. Option B is incorrect because the listener configuration affects whether traffic is forwarded to targets, not whether the ALB itself accepts incoming connections from allowed IPs. Option D is incorrect because the ALB uses an internet-facing scheme; if it were internal, it would not have a public DNS name.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group rule is blocking return traffic; security groups are stateful.
Why it's wrong here
Security groups are stateful and automatically allow return traffic, so this would not cause the issue.
- ✗
The ALB listener is not configured to forward traffic to the target group.
Why it's wrong here
A missing listener or target group configuration would cause the ALB to not forward requests, but it would still accept connections from allowed IPs if the network path is correct.
- ✓
The public subnet does not have a route to an internet gateway.
Why this is correct
For internet-facing ALBs, the subnets must have a default route to an internet gateway. Without it, internet traffic cannot reach the ALB.
- ✗
The ALB is using an internal scheme instead of internet-facing.
Why it's wrong here
The ALB has a public DNS name, indicating it is internet-facing. If it were internal, it would not have a public DNS name.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.