ANS-C01 Public IP address Practice Question
Network Topology
An EC2 instance with the attached network interface shown above is unable to reach the internet. The instance is in a public subnet with a route to an internet gateway. The security group allows outbound traffic. What is the most likely cause?
⚠ Common exam trap
The trap is that candidates often overlook the requirement for a public IP address when the route table is correctly configured. They may mistakenly focus on route issues or source/destination check.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network interface's attachment status is 'attached', but the instance may not have a public IP address.
The instance is in a public subnet with a route to an internet gateway, and the security group allows outbound traffic. However, for an instance in a public subnet to reach the internet directly, it must have a public IP address (either assigned automatically or as an Elastic IP). Without a public IP, the internet gateway cannot translate the instance's private IP to a public one, so outbound traffic fails. The route table is correct (contains 0.0.0.0/0 pointing to the internet gateway), source/destination check enabled is normal and does not block internet access, and the security group is associated and allows outbound traffic. Therefore, the most likely cause is the lack of a public IP address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The source/destination check is enabled, which prevents the instance from sending traffic to the internet if it is not the source of the traffic.
Why it's wrong here
The source/destination check is enabled by default on EC2 instances and is normal; it does not prevent the instance from reaching the internet. This is not the cause.
- ✓
The network interface's attachment status is 'attached', but the instance may not have a public IP address.
Why this is correct
An instance in a public subnet needs a public IP address for the internet gateway to route traffic to and from the internet. Without it, even with proper routes and security groups, internet access fails. This is the most likely cause.
- ✗
The route table for the subnet does not have a 0.0.0.0/0 route pointing to the internet gateway.
Why it's wrong here
The stem states the subnet has a route to the internet gateway, so the default route is present. This is not the issue.
- ✗
The security group is not associated with the network interface.
Why it's wrong here
The security group is associated with the network interface and allows outbound traffic, so this is not the cause.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.