SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Exhibit

Refer to the exhibit.

Resources:
  myVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
  mySubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref myVPC
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
  myInternetGateway:
    Type: AWS::EC2::InternetGateway
  myAttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref myVPC
      InternetGatewayId: !Ref myInternetGateway
  myRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref myVPC
  myRoute:
    Type: AWS::EC2::Route
    DependsOn: myAttachGateway
    Properties:
      RouteTableId: !Ref myRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref myInternetGateway
  mySubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref mySubnet
      RouteTableId: !Ref myRouteTable

A company deploys the above CloudFormation template. After deployment, an EC2 instance launched in mySubnet can access the internet. However, the instance cannot receive inbound traffic from the internet. What is the MOST likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

No security group or network ACL allows inbound traffic.

The template does not configure a security group or network ACL to allow inbound traffic. The route table and internet gateway are correctly set up for outbound traffic. Option A is wrong because the subnet has MapPublicIpOnLaunch: true. C is wrong because the route exists. D is wrong because the VPC is not missing an internet gateway.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The subnet does not have auto-assign public IP enabled.
Why it's wrong here
MapPublicIpOnLaunch is set to true.
✓
No security group or network ACL allows inbound traffic.
Why this is correct
Inbound traffic is blocked by default.
✗
The VPC does not have an internet gateway attached.
Why it's wrong here
The attachment is present.
✗
The route table does not have a route to the internet gateway.
Why it's wrong here
The route is present.

Visual reference

Go deeper

SAP-C02 Continuous Improvement for Existing Solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question