ANS-C01 Network Management and Operations Practice Question
A company uses AWS CloudFormation to manage its network infrastructure. After a recent update, the stack fails to update, with an error indicating that a security group rule conflicts with an existing rule. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The template attempts to add a security group rule that already exists.
The most likely cause is that the CloudFormation template is attempting to add a security group rule that already exists. AWS CloudFormation does not allow duplicate security group rules; if the same protocol, port range, and source (CIDR or security group) are specified, the update will fail with a conflict error. Option A is incorrect because the CIDR block not being in the same VPC is not a factor for security group rules; they can reference external CIDRs. Option B is incorrect because a deleted security group would result in a different error (e.g., referencing a non-existent group). Option C is incorrect because exceeding service quotas yields a different error message.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CIDR block in the rule is not in the same VPC.
Why it's wrong here
Security group rules can have any CIDR; no conflict from that.
- ✗
The referenced security group was deleted outside of CloudFormation.
Why it's wrong here
Deleted security group would cause dependency error, not conflict.
- ✗
The stack update exceeded the service quota for security groups.
Why it's wrong here
Quota exceeded would give a limit error, not a conflict.
- ✓
The template attempts to add a security group rule that already exists.
Why this is correct
AWS rejects duplicate rules to avoid ambiguity.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.