SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A DevOps engineer notices that an EC2 instance is running but is not reachable via SSH. The instance was launched with a security group that allows SSH from anywhere (0.0.0.0/0). What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The subnet's network ACL is blocking inbound SSH traffic.
The most likely cause is that the subnet's network ACL is blocking inbound SSH traffic. While the security group allows SSH from anywhere (0.0.0.0/0), network ACLs operate at the subnet level and can override security group rules. If the network ACL denies inbound traffic on port 22, SSH connections will be blocked. Option A is less likely because even without a public IP, the instance could be reached via private IP from within the VPC; the scenario implies external SSH access. Option B is incorrect because system status checks indicate underlying hardware issues, not connectivity problems. Option C is incorrect because the security group is attached by default when launching an instance, and the question confirms it allows SSH.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The instance does not have a public IP address.
Why it's wrong here
While an instance without a public IP cannot be reached from the internet, the question implies SSH from the internet is allowed by the security group, so the missing public IP is a possible cause but less common than a network ACL misconfiguration.
- ✗
The instance is failing system status checks.
Why it's wrong here
System status checks monitor the health of the underlying hardware; a failing check would cause the instance to stop or be impaired, but it wouldn't specifically block SSH traffic.
- ✗
The security group is not attached to the instance.
Why it's wrong here
Security groups are attached at launch; if the security group were not attached, SSH would still be blocked even if the rule exists, but the question states the security group allows SSH.
- ✓
The subnet's network ACL is blocking inbound SSH traffic.
Why this is correct
Network ACLs are stateless and can block traffic even if the security group allows it. If the inbound rule for port 22 is missing or denied in the network ACL, SSH connections will be dropped.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.