ANS-C01 Network Implementation Practice Question

A network engineer is troubleshooting connectivity between two EC2 instances in the same VPC but different subnets. The instances can ping each other's private IP addresses, but traffic on TCP port 443 fails. What is the most likely cause?

⚠ Common exam trap

The ANS-C01 exam often tests the distinction between stateful security groups and stateless network ACLs, and the trap here is that candidates assume ping success means all Layer 4 traffic is fine, ignoring that security groups and ACLs can selectively block specific ports while allowing others.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Security group or network ACL rules blocking port 443.

Since the instances can ping each other, ICMP traffic is working, which rules out routing issues and confirms that the instances are reachable at Layer 3. TCP port 443 failing specifically indicates that a firewall rule is blocking the HTTPS traffic. Security groups are stateful and operate at the instance level, while network ACLs are stateless and operate at the subnet level; either can block port 443 while allowing ICMP, making this the most likely cause.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
VPC Flow Logs misconfiguration.
Why it's wrong here
Flow logs are passive.
✗
Internet gateway not attached to the VPC.
Why it's wrong here
Internal traffic does not use IGW.
✓
Security group or network ACL rules blocking port 443.
Why this is correct
Port 443 is likely blocked by a firewall rule.
✗
Missing route in the route table.
Why it's wrong here
Routes are not port-specific; ICMP works.

Visual reference

Go deeper

ANS-C01 Network Implementation Practice Question

Why each option matters

Option-by-option breakdown

Related to this question