ANS-C01 Network Security, Compliance and Governance Practice Question
Network Topology
A security group is configured as shown. An EC2 instance in the same VPC with IP 10.0.1.50 can connect to the instance on port 443. An on-premises client with IP 203.0.113.5 cannot connect. What is the most likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group only allows traffic from the 10.0.0.0/16 CIDR
The security group inbound rule only allows traffic from the 10.0.0.0/16 CIDR block. The on-premises client IP (203.0.113.5) is outside that range, so the connection is implicitly denied. Option A is incorrect because security groups are stateful, so return traffic is allowed automatically. Option B is incorrect because HTTPS uses TCP, not UDP. Option D is incorrect because security groups do not support explicit deny rules; they only have allow rules, and any traffic not matching an allow rule is implicitly denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group's outbound rules block return traffic
Why it's wrong here
Outbound is allow all by default.
- ✗
The protocol is incorrect; HTTPS uses UDP
Why it's wrong here
HTTPS uses TCP.
- ✓
The security group only allows traffic from the 10.0.0.0/16 CIDR
Why this is correct
On-premises IP is not in that range.
- ✗
The security group has a deny rule for the on-premises IP
Why it's wrong here
No deny rule exists.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.