SAP-C02 Design for New Solutions Practice Question
Network Topology
Refer to the exhibit. An architect is troubleshooting an EC2 instance that is not responding to health checks from an Application Load Balancer. The instance is in the 'running' state. Which of the following is the most likely cause?
⚠ Common exam trap
SAP-C02 often tests the misconception that a running instance with a healthy OS is automatically reachable by the ALB, when security group and NACL rules on the health check path are the usual culprits.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group is blocking the health check traffic.
The most likely cause is that the instance's security group is not allowing inbound traffic from the ALB's security group on the health check port. ALB health checks originate from the load balancer's ENIs, so the target's security group must explicitly permit that traffic; otherwise the instance appears healthy at the OS level but fails ALB checks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The security group is blocking the health check traffic.
Why this is correct
A security group that omits the load balancer's health check port or source blocks the probe packets, so the target never receives them and is marked unhealthy despite the instance running. Allowing the health check port from the ALB security group or subnet CIDR resolves it.
- ✗
The instance is in a stopped state.
Why it's wrong here
The stem explicitly states the instance is in the running state, so a stopped state contradicts the given facts. Instance state is tempting because stopped instances genuinely fail health checks and are removed from the target group, making it the right answer when the instance is not running.
- ✗
The instance is impaired due to an AWS issue.
Why it's wrong here
An AWS-side impairment would affect the instance's status checks, yet the stem gives a running instance failing only ALB health checks, which points to the target group's health check path, port, or security group configuration. Blaming AWS is tempting because infrastructure faults do occur, but the evidence here does not support it.
- ✗
The instance has exhausted its CPU credits.
Why it's wrong here
CPU credit exhaustion throttles performance but does not stop the instance answering health checks, since the ALB health check merely needs a response on the configured port and path. CPU credits are tempting because T-instance throttling degrades responsiveness, and would matter if checks timed out under sustained load.
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 984 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.