ANS-C01 Network Implementation Practice Question

Exhibit

Refer to the exhibit.

```
VPC Flow Logs version 2
account-id 123456789012
interface-id eni-0a1b2c3d4e5f67890
srcaddr 10.0.1.10
dstaddr 10.0.2.10
srcport 12345
dstport 443
protocol 6
packets 10
bytes 1500
start 1625097600
end 1625097660
action ACCEPT
log-status OK
```

A network engineer is analyzing VPC Flow Logs for a VPC with CIDR 10.0.0.0/16. The exhibit shows a sample log entry. The engineer notices that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted. However, the application team reports that the connection is failing. What is the most likely reason for the disconnect?

⚠ Common exam trap

AWS often tests the distinction between network-layer acceptance (ACCEPT in flow logs) and application-layer success, trapping candidates who assume an ACCEPT record guarantees a successful connection.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The application layer is failing to establish a proper connection.

The VPC Flow Logs show that traffic from 10.0.1.10 to 10.0.2.10 on port 443 is being accepted (ACCEPT record), which indicates that the network layer (security groups, network ACLs, and routing) is permitting the traffic. Since the application team reports the connection is failing, the issue must be at a higher layer, specifically the application layer (e.g., TLS handshake failure, certificate mismatch, or the application not listening on port 443). Flow logs capture only network-layer metadata (IP, port, protocol, action) and cannot detect application-layer errors.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The security groups are blocking the traffic.
Why it's wrong here
The flow log action is ACCEPT, indicating no block.
✗
The route tables are incorrectly configured, causing packet loss.
Why it's wrong here
If packets were lost, the action would likely be REJECT or not logged.
✗
The flow logs are misconfigured and not capturing all traffic.
Why it's wrong here
The log shows traffic was captured.
✓
The application layer is failing to establish a proper connection.
Why this is correct
Flow logs only show network-level acceptance; application issues are not captured.

Visual reference

Go deeper

ANS-C01 Network Implementation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question