ANS-C01 Network Security, Compliance and Governance Practice Question
Exhibit
Refer to the exhibit. [root@ip-10-0-1-5 ~]# tcpdump -i eth0 -n port 443 09:32:15.123456 IP 203.0.113.5.34567 > 10.0.1.5.443: Flags [S], seq 12345, win 65535, options [mss 1460], length 0 09:32:15.123456 IP 10.0.1.5.443 > 203.0.113.5.34567: Flags [S.], seq 54321, ack 12346, win 65535, options [mss 1460], length 0 09:32:15.123456 IP 203.0.113.5.34567 > 10.0.1.5.443: Flags [.], ack 54322, win 65535, length 0
A security engineer runs tcpdump on an EC2 instance (10.0.1.5) and sees the output above. The instance is in a private subnet with a security group that allows inbound HTTPS from 0.0.0.0/0. The instance is behind a Network Load Balancer (NLB) that has a public IP. The engineer is unable to establish an HTTPS connection from the internet. What is the most likely cause?
⚠ Common exam trap
AWS often tests the misconception that security group rules are the primary cause of connectivity issues with NLBs, but the real trap is that candidates overlook how NLB health checks directly control traffic forwarding, and a failing health check silently drops all traffic even when security groups and routes are correctly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NLB's target group health checks are failing, causing the NLB to consider the instance unhealthy.
The tcpdump output shows the NLB's health check traffic (SYN packets from the NLB's private IPs) reaching the instance, but the engineer cannot establish an HTTPS connection from the internet. If the target group health checks are failing, the NLB marks the instance as unhealthy and stops forwarding traffic to it, which would prevent any internet HTTPS connections from reaching the instance. This is the most likely cause because the security group allows inbound HTTPS from 0.0.0.0/0, and the NLB does not preserve source IP by default, so the security group is not blocking traffic from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NLB is not preserving the source IP, so the security group is blocking the traffic.
Why it's wrong here
The source IP seen is the NLB's IP, but the security group allows all inbound, so it's not blocking.
- ✓
The NLB's target group health checks are failing, causing the NLB to consider the instance unhealthy.
Why this is correct
The tcpdump shows the handshake from the NLB, but if health checks fail, the NLB stops sending traffic.
- ✗
The instance's operating system firewall is blocking the connection.
Why it's wrong here
The tcpdump shows successful handshake, so OS firewall is not blocking.
- ✗
The security group is blocking inbound traffic from the NLB.
Why it's wrong here
The security group allows all inbound HTTPS, so it is not blocking.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.