ANS-C01 Network Implementation Practice Question
Network Topology
Refer to the exhibit. An EC2 instance in a VPC is assigned a public IP via an Elastic IP address. The instance is not reachable from the internet, although it has a security group allowing inbound HTTP traffic from 0.0.0.0/0. The VPC has an Internet Gateway attached to the route table of the subnet. What is the MOST likely cause?
⚠ Common exam trap
The ANS-C01 exam often tests the misconception that a public IP and a permissive security group alone guarantee internet connectivity, ignoring the critical requirement of a default route to the Internet Gateway in the subnet's route table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The subnet route table does not have a default route (0.0.0.0/0) to the Internet Gateway
The most likely cause is that the subnet's route table lacks a default route (0.0.0.0/0) pointing to the Internet Gateway (IGW). Without this route, traffic destined for the internet from the instance has no path to the IGW, and return traffic from the internet cannot reach the instance. Even with a public Elastic IP and a permissive security group, the VPC's routing logic prevents internet-bound packets from being forwarded to the IGW.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The subnet route table does not have a default route (0.0.0.0/0) to the Internet Gateway
Why this is correct
For an instance with a public Elastic IP to be reachable from the internet, the subnet’s route table must contain a default route (0.0.0.0/0) pointing to the Internet Gateway. Without this route, outbound traffic from the instance cannot reach the internet, and inbound response traffic cannot return, even though the security group permits HTTP from 0.0.0.0/0 and the Internet Gateway is attached.
- ✗
The source/destination check is enabled and should be disabled
Why it's wrong here
Source/destination check should be enabled for normal instances.
- ✗
The security group is blocking inbound traffic
Why it's wrong here
The security group allows HTTP from 0.0.0.0/0.
- ✗
The Elastic IP is not correctly associated with the instance
Why it's wrong here
The exhibit shows it is associated.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.