ANS-C01 Network Management and Operations Practice Question
Exhibit
Refer to the exhibit. VPC Flow Logs (vpc-flow-logs-1) - capture window: 2023-09-15T10:00:00Z to 2023-09-15T11:00:00Z 2 123456789010 eni-0a1b2c3d4e5f6g7h 10.0.1.5 10.0.2.10 443 54321 6 10 1000 1623456789 1623456790 ACCEPT OK 2 123456789010 eni-0a1b2c3d4e5f6g7h 10.0.2.10 10.0.1.5 54321 443 6 10 1000 1623456790 1623456795 ACCEPT OK 2 123456789010 eni-0a1b2c3d4e5f6g7h 10.0.1.5 192.168.1.1 80 12345 6 20 2000 1623456800 1623456810 ACCEPT OK 2 123456789010 eni-0a1b2c3d4e5f6g7h 10.0.1.5 10.0.2.10 443 54322 6 10 1000 1623456810 1623456820 ACCEPT OK 2 123456789010 eni-0a1b2c3d4e5f6g7h 10.0.2.10 10.0.1.5 54322 443 6 10 1000 1623456820 1623456830 ACCEPT OK
Refer to the exhibit. A network engineer is analyzing VPC Flow Logs to troubleshoot connectivity issues. The engineer notices that traffic from 10.0.1.5 to 192.168.1.1 on port 80 is logged as ACCEPT, but the application team reports that the web request failed. What is the most likely cause?
⚠ Common exam trap
AWS often tests the misconception that an ACCEPT log entry guarantees end-to-end connectivity, when in fact it only confirms that the packet passed the hypervisor-level firewall rules, not that the destination host processed it or that a return path exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The destination host 192.168.1.1 is not reachable or does not have a route back to the source.
The VPC Flow Logs record the state of the TCP handshake from the perspective of the network path, but they do not confirm that the destination host successfully processed the request or that a return path exists. If 192.168.1.1 has no route back to 10.0.1.5, the initial SYN-ACK will never reach the source, causing the application to time out even though the forward traffic was accepted by the network ACL and security group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPC Flow Logs are not capturing all packets due to sampling.
Why it's wrong here
The log entry shows a specific captured packet; sampling would not affect this particular log.
- ✗
The network ACL is returning an ICMP unreachable message that is not logged.
Why it's wrong here
Network ACLs are stateless and would affect both directions; if ICMP were blocked, it would not cause an ACCEPT log.
- ✓
The destination host 192.168.1.1 is not reachable or does not have a route back to the source.
Why this is correct
The outbound packet was accepted, but the lack of a return path or the destination being down would cause the application to fail.
- ✗
The security group on the ENI is blocking outbound traffic to 192.168.1.1.
Why it's wrong here
The log shows ACCEPT, so the security group allowed the outbound traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.