PAS-C01 Migration Practice Question
Network Topology
Refer to the exhibit. An EC2 instance is running and has a public IP address. A security engineer needs to verify that the instance is not publicly accessible from the internet. Which additional step is required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the security group inbound rules.
Security group inbound rules determine whether traffic from the internet is allowed to reach the instance. Option A is incorrect because having a public IP does not guarantee accessibility; the security group must allow inbound traffic. Option B is incorrect because the route table's internet gateway entry is necessary but not sufficient; inbound rules must permit access. Option D is incorrect because network ACLs provide stateless filtering at the subnet level, but the question specifically requires verifying that the instance is not publicly accessible, which is primarily controlled by security group inbound rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check if the instance has a public IP.
Why it's wrong here
Having a public IP does not guarantee internet accessibility; additional checks on inbound traffic controls are required to confirm the instance is not publicly accessible.
- ✗
Check the route table for an internet gateway.
Why it's wrong here
Checking the route table for an internet gateway is necessary for outbound traffic or inbound traffic that is initiated externally, but it does not determine whether inbound traffic to the instance is allowed. The security group must also permit the traffic.
- ✓
Check the security group inbound rules.
Why this is correct
The security group inbound rules explicitly control which traffic is allowed to reach the instance. To verify that the instance is not publicly accessible, you must check that no inbound rules allow traffic from 0.0.0.0/0 or any other public source.
- ✗
Check the network ACL of the subnet.
Why it's wrong here
Network ACLs provide stateless filtering at the subnet level, but they are not the primary control for instance-level inbound traffic. Even if the NACL allows traffic, the security group must also allow it; therefore, checking the security group is the additional step required.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.