ANS-C01 Network Design Practice Question
Exhibit
Refer to the exhibit. VPC Flow Logs entry: 2 123456789010 eni-12345678 10.0.1.5 203.0.113.50 443 38000 6 20 5000 1450670868 1450670868 ACCEPT OK And the following security group inbound rule: Type: Custom TCP, Protocol: TCP, Port Range: 443, Source: 10.0.0.0/16 And NACL inbound rule: Rule #100: Type: HTTP (80), Protocol: TCP, Port Range: 80, Source: 0.0.0.0/0, Allow Rule #120: Type: HTTPS (443), Protocol: TCP, Port Range: 443, Source: 10.0.0.0/16, Allow Rule #*: Type: All traffic, Protocol: All, Port Range: All, Source: 0.0.0.0/0, Deny
A network engineer analyzes a VPC Flow Log entry showing an ACCEPT for a TCP connection from 203.0.113.50 (internet) to 10.0.1.5 on port 443. The security group for the instance allows inbound HTTPS only from 10.0.0.0/16, and the NACL for the subnet has the rules shown. Why was the traffic accepted?
⚠ Common exam trap
AWS often tests the misconception that VPC Flow Log entries always represent the direction of traffic as seen by the network, when in fact they record the connection tuple as observed, which can be the reverse direction of the original request, leading candidates to incorrectly apply inbound security rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The flow log entry represents outbound traffic from the instance (source 10.0.1.5:443 to destination 203.0.113.50:38000). The security group's default outbound rule allows all traffic, and the NACL outbound (not shown) also allows it, resulting in ACCEPT.
The VPC Flow Log entry shows an ACCEPT for traffic from 203.0.113.50:38000 to 10.0.1.5:443. Because flow logs record connection state, this entry actually represents the return traffic of an outbound connection initiated by the instance (10.0.1.5) to the internet host on port 443. The security group's default outbound rule allows all traffic, and the NACL outbound rules (not shown) also permit it, so the return ACCEPT is valid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NACL inbound rule #120 allows HTTPS from 10.0.0.0/16, but the source is 203.0.113.50, so it should be denied.
Why it's wrong here
Same as above.
- ✗
The NACL inbound rule #100 allows HTTP from anywhere, and the traffic is HTTP.
Why it's wrong here
The traffic is HTTPS (port 443), not HTTP.
- ✗
The security group allows inbound HTTPS from 10.0.0.0/16, but the flow log source is 203.0.113.50, so it should be denied. The ACCEPT must be an error.
Why it's wrong here
Flow logs are accurate; the traffic was accepted because it was outbound from the instance.
- ✓
The flow log entry represents outbound traffic from the instance (source 10.0.1.5:443 to destination 203.0.113.50:38000). The security group's default outbound rule allows all traffic, and the NACL outbound (not shown) also allows it, resulting in ACCEPT.
Why this is correct
Correct interpretation of the flow log: source is the instance, destination is internet. Outbound is allowed by default.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.