SAP-C02 Security group statefulness Practice Question
Network Topology
An administrator runs the above commands and observes the outputs. The instance is in a public subnet with an internet gateway. What is the most likely issue preventing users from accessing the web server?
⚠ Common exam trap
The trap is that candidates may incorrectly blame missing outbound rules, overlooking the stateful nature of security groups. The real issue is often a restrictive inbound rule that does not permit traffic from the users' IP ranges.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group allows HTTP only from the IP range 203.0.113.0/24.
Security groups are stateful: if inbound HTTP traffic is allowed, the corresponding outbound response traffic is automatically allowed, regardless of outbound rules. Therefore, missing outbound rules cannot prevent responses. The most likely issue is that the security group only allows HTTP from the IP range 203.0.113.0/24. Users outside that range will be blocked, even though the instance is in a public subnet with an internet gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group allows SSH from a restricted IP, but not from the users.
Why it's wrong here
While SSH restriction exists, it does not affect web traffic; users cannot access the web server due to HTTP restriction, not SSH.
- ✗
The security group does not allow outbound traffic, so responses cannot be sent.
Why it's wrong here
Security groups are stateful; outbound rules are not required for response traffic. This is not the issue.
- ✓
The security group allows HTTP only from the IP range 203.0.113.0/24.
Why this is correct
Correct. The security group only allows HTTP from 203.0.113.0/24, which excludes many users, blocking access.
- ✗
The security group does not allow inbound HTTP traffic.
Why it's wrong here
Inbound HTTP is allowed (as implied by the scenario), so this is not the issue.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.