ANS-C01 Network Management and Operations Practice Question
A network engineer is troubleshooting network connectivity issues in a VPC. The engineer suspects that the network ACL is blocking traffic. Which TWO actions should the engineer take to verify this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the inbound and outbound rules of the network ACL.
Options A and D are correct because reviewing the inbound and outbound rules of the network ACL allows the engineer to check if traffic is explicitly blocked by the ACL, and enabling VPC Flow Logs with 'ACCEPT' or 'REJECT' status provides insight into whether the ACL is actually blocking the traffic. Option B is incorrect because security groups are stateful and work at the instance level, not at the subnet level like NACLs. Option C is incorrect because AWS CloudTrail records API activity, not network traffic. Option E is incorrect because AWS Direct Connect establishes a dedicated network connection but does not help verify if a NACL is blocking traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Review the inbound and outbound rules of the network ACL.
Why this is correct
NACL rules explicitly allow or deny traffic.
- ✗
Check the security group rules for the affected instances.
Why it's wrong here
Security groups are stateful and not directly related to NACL blocking.
- ✗
Use AWS CloudTrail to view network traffic logs.
Why it's wrong here
CloudTrail logs API calls, not network traffic.
- ✓
Enable VPC Flow Logs and filter for 'ACCEPT' or 'REJECT' status.
Why this is correct
Flow Logs can show whether NACL accepted or rejected packets.
- ✗
Test connectivity using AWS Direct Connect.
Why it's wrong here
Direct Connect is for on-premises connectivity, not troubleshooting NACL.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.