ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

vpc-flow-log-1234567890 2 123456789010 eni-1234567890abcdef 10.0.1.5 10.0.2.10 12345 80 6 100 2000 1625097600 1625097660 REJECT OK

Refer to the exhibit. A network engineer is analyzing a VPC Flow Log record from a VPC with CIDR 10.0.0.0/16. The record indicates a REJECT action. Which component is most likely blocking the traffic?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The destination instance's security group

Flow logs record traffic after security group and NACL evaluation. A REJECT indicates the traffic was dropped by a security group or NACL. Since the destination port is 80 (HTTP), a security group is likely blocking inbound HTTP. Option C is correct. Option A is wrong because the source IP is within the VPC. Option B is wrong because there is no indication of a missing route. Option D is wrong because NACL rules are stateless and would show REJECT if they block, but security groups are more common for instance-level blocking.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The destination instance's operating system firewall
Why it's wrong here
Flow logs capture traffic before reaching the OS.
✗
A missing route in the route table
Why it's wrong here
Missing routes would not generate a flow log record.
✓
The destination instance's security group
Why this is correct
Security groups evaluate inbound rules and can REJECT traffic.
✗
The network ACL of the destination subnet
Why it's wrong here
NACLs are stateless and would REJECT if a rule denies, but security group is more likely for a specific port.

Visual reference

Go deeper

ANS-C01 Network Security, Compliance and Governance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question