SCS-C02 Infrastructure Security Practice Question
A security engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises server over a Direct Connect virtual interface. The EC2 instance has a security group that allows outbound traffic to the on-premises CIDR block (10.0.0.0/16). The VPC has a route table entry pointing the on-premises CIDR to the virtual private gateway. The on-premises firewall shows that packets are received from the EC2 instance but responses are not reaching the instance. What is the most likely cause?
⚠ Common exam trap
Candidates often assume security groups or network ACLs are the cause of asymmetric connectivity issues, but the real problem is the missing return route on the on-premises side, which is a common misconfiguration in hybrid networking scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The on-premises router does not have a route pointing the VPC CIDR back to the Direct Connect interface.
The on-premises firewall logs show packets are received from the EC2 instance, but responses are not reaching it. This indicates a routing issue on the on-premises side: the on-premises router must have a route pointing the VPC CIDR back to the Direct Connect interface (virtual interface) for return traffic to be forwarded correctly. Without this return route, the on-premises server sends responses via its default route (likely the internet), which are dropped by the VPC security group or never reach the EC2 instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The on-premises router does not have a route pointing the VPC CIDR back to the Direct Connect interface.
Why this is correct
The VPC has a route for the on-premises CIDR pointing to the virtual private gateway, so outbound packets traverse the Direct Connect virtual interface. However, for successful two-way communication, the on-premises router must have a route for the VPC CIDR that points back to the same Direct Connect interface. Because this return route is missing, response packets are either sent to a default route or dropped, so hosts in the VPC see no replies. This is a classic asymmetric routing failure.
- ✗
The network ACL for the subnet is blocking outbound traffic to the on-premises CIDR.
Why it's wrong here
If the subnet's network ACL were blocking outbound traffic to the on-premises CIDR, the VPC instances would be unable to send any packets toward Direct Connect, and the on-premises side would receive nothing at all. The scenario demonstrates that outbound traffic is reaching the on-premises network, which proves the NACL is permitting the egress flow. NACLs are stateless and require explicit allow rules for both outbound and inbound traffic, but here only the return path is broken.
- ✗
The virtual private gateway is not attached to the VPC.
Why it's wrong here
A virtual private gateway that is not attached to the VPC would leave the VPC route table without any viable target for Direct Connect traffic, preventing all outbound packets from ever leaving the VPC. Since the observed symptoms show outbound traffic successfully arriving at on-premises, the gateway must be attached and operational. An unattached gateway would be a total connectivity failure, not a one-way connectivity issue.
- ✗
The security group does not allow inbound traffic from the on-premises server.
Why it's wrong here
Security groups are stateful: if the instance's outbound rule permits traffic to the on-premises server, the security group automatically allows the corresponding inbound response traffic, even without an explicit inbound rule. Therefore, a missing inbound rule for the on-premises CIDR cannot cause the return packets to be dropped. The issue lies in an external router lacking a return route, not in the security group configuration.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.