A security engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises server over a Direct Connect virtual interface. The EC2 instance has a security group that allows outbound traffic to the on-premises CIDR block (10.0.0.0/16). The VPC has a route table entry pointing the on-premises CIDR to the virtual private gateway. The on-premises firewall shows that packets are received from the EC2 instance but responses are not reaching the instance. What is the most likely cause?
The VPC has a route for the on-premises CIDR pointing to the virtual private gateway, so outbound packets traverse the Direct Connect virtual interface. However, for successful two-way communication, the on-premises router must have a route for the VPC CIDR that points back to the same Direct Connect interface. Because this return route is missing, response packets are either sent to a default route or dropped, so hosts in the VPC see no replies. This is a classic asymmetric routing failure.
Why this answer
The on-premises firewall logs show packets are received from the EC2 instance, but responses are not reaching it. This indicates a routing issue on the on-premises side: the on-premises router must have a route pointing the VPC CIDR back to the Direct Connect interface (virtual interface) for return traffic to be forwarded correctly. Without this return route, the on-premises server sends responses via its default route (likely the internet), which are dropped by the VPC security group or never reach the EC2 instance.
Exam trap
The trap here is that candidates often assume security groups or network ACLs are the cause of asymmetric connectivity issues, but the real problem is the missing return route on the on-premises side, which is a common misconfiguration in hybrid networking scenarios.
How to eliminate wrong answers
Option B is wrong because the network ACL for the subnet is not blocking outbound traffic to the on-premises CIDR; the question states the EC2 instance can send packets (they are received on-premises), so outbound ACL rules are not the issue. Option C is wrong because if the virtual private gateway were not attached to the VPC, the EC2 instance would not be able to send packets to the on-premises CIDR at all (the route table entry would be invalid), yet packets are received on-premises. Option D is wrong because the security group does not need to allow inbound traffic from the on-premises server for the response to reach the EC2 instance; security groups are stateful, so if the outbound traffic is allowed, the return traffic is automatically permitted regardless of inbound rules.