ANS-C01 Network Security, Compliance and Governance Practice Question
A security engineer notices that an EC2 instance in a public subnet is receiving inbound SSH traffic from a range of IP addresses that should be blocked. Which two actions should the engineer take to troubleshoot? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the Security Group rules attached to the instance
Options C and E are correct. Reviewing Security Group rules helps determine if the security group is allowing SSH traffic from the unwanted IPs. Checking VPC Flow Logs can reveal the actual source IP addresses of the traffic. Option A is incorrect because instance metadata does not contain network access rules. Option B is incorrect because the route table determines routing, not access control. Option D is incorrect because while Network ACLs can block traffic, they are stateless and affect the entire subnet; the first check should be the security group attached to the instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the instance metadata for IP restrictions
Why it's wrong here
Instance metadata does not contain network ACL or security group information.
- ✗
Check the route table associated with the subnet
Why it's wrong here
Route tables do not affect inbound traffic to the instance.
- ✓
Review the Security Group rules attached to the instance
Why this is correct
Security groups control inbound traffic to the instance.
- ✗
Check the Network ACL associated with the subnet
Why it's wrong here
NACLs are stateless and might be allowing traffic, but security groups are the first line of defense for instance-level filtering.
- ✓
Check VPC Flow Logs to identify the source IP addresses
Why this is correct
Flow logs capture traffic metadata, helping identify the source.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.