ANS-C01 Network Management and Operations Practice Question
A network engineer is troubleshooting an issue where an EC2 instance in a public subnet cannot reach the internet. The instance has a public IP, and the route table has a default route to an internet gateway. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network ACL is blocking outbound traffic
Even with correct routes, if the subnet's network ACL does not allow outbound traffic, the instance cannot reach the internet. Network ACLs are stateless and must allow both outbound and inbound ephemeral ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The network ACL is blocking outbound traffic
Why this is correct
Network ACLs are stateless and must explicitly allow outbound traffic and inbound return traffic.
- ✗
The internet gateway is not attached to the VPC
Why it's wrong here
If the internet gateway were not attached, the route to it would be invalid, but the scenario says the route exists.
- ✗
The security group does not allow outbound HTTP traffic
Why it's wrong here
Security groups are stateful; if outbound traffic is allowed, return traffic is automatically allowed.
- ✗
The instance does not have a public IP
Why it's wrong here
The scenario states the instance has a public IP.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer notices that traffic from an EC2 instance in a public subnet to the internet is not working. The instance has a public IP assigned and is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What should the engineer check next?
medium- A.Ensure the network ACL allows outbound traffic.
- ✓ B.Verify that the route table for the subnet has a 0.0.0.0/0 route pointing to the internet gateway.
- C.Confirm that the internet gateway is attached to the VPC.
- D.Check if the instance has a public IP assigned.
Why B: Even if the instance has a public IP, if the subnet's route table does not have a default route (0.0.0.0/0) pointing to the internet gateway, traffic to the internet will fail. This is a common misconfiguration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.