ANS-C01 Network Implementation Practice Question

Exhibit

Refer to the exhibit.

CLI output from a VPC Flow Log:

2 123456789010 eni-12345 10.0.1.5 10.0.2.10 443 54872 6 10 1000 1432919027 1432919028 ACCEPT OK
2 123456789010 eni-12345 10.0.1.5 10.0.2.10 443 54873 6 25 4000 1432919028 1432919029 REJECT OK

An engineer is reviewing VPC Flow Logs for connectivity issues between two EC2 instances (10.0.1.5 and 10.0.2.10) on TCP port 443. The first log entry shows ACCEPT, the second shows REJECT. What is the most likely cause of the REJECT?

⚠ Common exam trap

The ANS-C01 exam often tests the nuance that asymmetric routing can cause security groups to drop return traffic. Even though security groups are stateful, if the return packet takes a different path (e.g., different subnet or ENI) than the outbound packet, the security group on that interface may not recognize it as part of an established connection and will evaluate it against inbound rules. If no appropriate inbound rule exists, the packet is REJECTED. Candidates frequently assume a REJECT on return traffic must be due to a stateless NACL, overlooking this asymmetric routing scenario.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The network ACL is blocking the traffic due to an incorrect inbound rule.

The first log entry shows ACCEPT for the outbound SYN packet, indicating the initial connection attempt succeeded. The second REJECT indicates that the return SYN-ACK packet from 10.0.2.10 to 10.0.1.5 was dropped. Since security groups are stateful and automatically allow return traffic for established connections, they cannot cause this REJECT. Network ACLs are stateless, so they require explicit inbound rules for return traffic. If the inbound rule on the NACL for the subnet of 10.0.2.10 does not allow the return traffic (e.g., using an ephemeral port range), it will be REJECTED. Therefore, option B is correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The destination instance has an incorrect network interface configuration.
Why it's wrong here
Incorrect network interface configuration would likely cause a different connectivity issue, not a REJECT specifically on return traffic in VPC Flow Logs.
✓
The network ACL is blocking the traffic due to an incorrect inbound rule.
Why this is correct
Correct. Network ACLs are stateless, so they require explicit inbound rules for return traffic. The REJECT on the return packet indicates a missing or incorrect inbound NACL rule.
✗
The route table for the subnet does not have a route to the destination.
Why it's wrong here
Missing route in the route table would cause the packet to be dropped before reaching the destination, not a REJECT on the return path.
✗
A security group rule is blocking the return traffic.
Why it's wrong here
Incorrect. Security groups are stateful and automatically allow return traffic for established connections, so they would not cause a REJECT on the return packet.

Visual reference

Go deeper

ANS-C01 Network Implementation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question