ANS-C01 Network Implementation Practice Question
A network engineer is troubleshooting connectivity issues from an on-premises network to an AWS VPC over a Direct Connect private VIF. The VPC has a virtual private gateway attached. The on-premises router can ping the private IP of an EC2 instance in the VPC, but application traffic (TCP port 443) fails. What is the most likely cause?
⚠ Common exam trap
Many candidates assume ping success implies full application-layer connectivity, but security groups can selectively block specific protocols or ports while allowing ICMP, leading to a false sense of network health.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group for the EC2 instance does not allow inbound HTTPS traffic.
Since the on-premises router can ping the EC2 instance's private IP, Layer 3 connectivity is working, which rules out routing and BGP issues. The failure of TCP port 443 specifically points to a firewall or access control blocking the application traffic. A security group acts as a virtual firewall at the instance level, and by default it denies all inbound traffic unless explicitly allowed. Therefore, the most likely cause is that the security group for the EC2 instance does not have an inbound rule permitting HTTPS (TCP 443) traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The network ACL in the VPC is blocking outbound traffic.
Why it's wrong here
NACLs are stateless; if ping works, both inbound and outbound rules allow ICMP. However, TCP could be blocked if NACL rules are different for TCP, but ping success suggests NACLs are not the issue.
- ✓
The security group for the EC2 instance does not allow inbound HTTPS traffic.
Why this is correct
Security groups are stateful, so outbound return traffic is allowed automatically. The inbound rule for HTTPS must be present.
- ✗
The BGP session is in the 'Idle' state.
Why it's wrong here
Ping works, so BGP is up and routes are exchanged.
- ✗
The route table associated with the virtual private gateway does not have a route to the on-premises network.
Why it's wrong here
The virtual private gateway does not have its own route table; routes are added to the VPC route tables.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.