ANS-C01 Network Security, Compliance and Governance Practice Question
A network engineer is troubleshooting connectivity issues between an EC2 instance and an RDS database in the same VPC. The EC2 instance can connect to the database, but the connection is slow. Which TWO actions should the engineer take to diagnose the issue? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the security group for the EC2 instance allows outbound traffic on the database port, and the database security group allows inbound from the EC2 instance.
Options C and D are correct. Checking security group rules (C) ensures proper allow rules for communication between the EC2 instance and RDS database. Reviewing VPC Flow Logs (D) can reveal dropped packets or latency issues. Option A is wrong because the default route to the internet is not relevant to internal VPC traffic. Option B is wrong because network ACLs are stateless and require explicit rules for both inbound and outbound traffic, but statefulness is not the issue here. Option E is wrong because route propagation is for VPN/Direct Connect, not for this connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify the route table for the database subnet to ensure there is a default route to the internet.
Why it's wrong here
Not relevant for internal traffic.
- ✗
Check the network ACL for the database subnet to ensure it is stateful.
Why it's wrong here
NACLs are stateless; they need explicit rules for return traffic.
- ✓
Verify that the security group for the EC2 instance allows outbound traffic on the database port, and the database security group allows inbound from the EC2 instance.
Why this is correct
Security group misconfigurations can cause slow connections.
- ✓
Check VPC Flow Logs to analyze traffic patterns and identify drops or latency.
Why this is correct
Flow Logs provide visibility into traffic.
- ✗
Check the route propagation settings on the VPC.
Why it's wrong here
Not relevant for intra-VPC connectivity.
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.