SOA-C02 Networking and Content Delivery Practice Question

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to send traffic to an EC2 instance in subnet-B. Both instances are in the same VPC and have appropriate security group rules. However, traffic is not reaching the destination. What is the MOST likely cause?

⚠ Common exam trap

SOA-C02 often tests the misconception that security groups are the only access control for EC2 instances, causing candidates to overlook stateless NACLs that can block traffic even when security groups allow it.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The network ACL associated with subnet-B is denying inbound traffic from subnet-A.

Network ACLs are stateless and must explicitly allow both inbound and outbound traffic for each subnet. If the NACL on subnet-B denies inbound traffic from subnet-A's CIDR (10.0.1.0/24), the packets will be dropped even though security groups allow them. Since the instances are in the same VPC, the default route table includes a local route for the entire VPC CIDR (10.0.0.0/16), so routing is not the issue. Security groups are stateful and already allow the traffic per the scenario.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The route table for subnet-A does not have a route for subnet-B's CIDR.
Why it's wrong here
Within a VPC, the main route table automatically contains a local route that matches the entire VPC CIDR (10.0.0.0/16), which ensures that any traffic destined to any subnet within the same VPC is routed locally. Thus, even if subnet-A's route table has no explicit route to subnet-B's specific CIDR, the local route already provides reachability. Route tables in a VPC inherently allow all intra-VPC communication via this local route, so this cannot be the cause of the failure.
✓
The network ACL associated with subnet-B is denying inbound traffic from subnet-A.
Why this is correct
Network ACLs operate at the subnet boundary and are stateless, meaning both inbound and outbound rules must be evaluated independently. If subnet-B's inbound NACL rules lack an allow rule for traffic from subnet-A's CIDR, the traffic is implicitly denied even if security groups permit it. Since NACLs are enforced before traffic reaches the instance, this would block communication even with appropriate security group rules.
✗
The security group on the destination instance does not allow inbound traffic from the source instance.
Why it's wrong here
Security groups are stateful, instance-level firewalls that automatically allow return traffic, and they only affect traffic to the instances they are attached to. The scenario explicitly states that appropriate security group rules are present, so the destination instance's security group is not the issue. If a missing inbound rule were causing the failure, you would typically observe connection timeouts, which contradicts the premise.
✗
The VPC peering connection is not established between the two subnets.
Why it's wrong here
VPC peering connections allow routing between separate VPCs, not between subnets within the same VPC. Subnet-A and subnet-B reside in the same VPC (10.0.0.0/16), so they already have connectivity through the VPC's local route, making VPC peering unnecessary. You cannot even establish a peering connection between a VPC and itself, so the lack of one is completely irrelevant to this intra-VPC communication problem.

Visual reference

Go deeper

SOA-C02 Networking and Content Delivery Practice Question

Why each option matters

Option-by-option breakdown

Related to this question