SOA-C02 Monitoring, Logging, and Remediation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Check that the instance is associated with an Elastic IP address.

  Why it's wrong here

  An Elastic IP (EIP) is a static public IPv4 address that can be attached to an instance, but the instance in this scenario already has a public IP, so a second public IP would not change its ability to reach the internet. The issue of missing internet connectivity after security group and NACL checks points to a routing problem, not to the public IP address being dynamic or absent. Associating an EIP would only be relevant if the instance lacked a public IP and you needed a fixed address; it does not create or modify the subnet's route table entry to an Internet Gateway.

• ✓

  Verify that the subnet's route table has a route to an internet gateway.

  Why this is correct

  A public subnet's route table must contain a default route (0.0.0.0/0) that targets an Internet Gateway (IGW) for outbound and inbound internet traffic to flow. Even with a public IP and permissive security group and NACL rules, if this route is missing or points to a misconfigured target, the instance cannot send or receive packets to/from the internet. Verifying the route table is the correct next step because it directly addresses the network path after you've already confirmed the stateful and stateless filtering layers.

• ✗

  Confirm that the instance's operating system firewall is disabled.

  Why it's wrong here

  Although the operating system firewall can block internet traffic, the instance cannot communicate with the internet at all, and the question states that security groups and NACLs have already been verified. Disabling the OS firewall is a broad, disruptive action that should only be taken after confirming that network-layer routing and addressing are correct, otherwise you may mask a more fundamental configuration issue. In the AWS troubleshooting hierarchy, the route table and network path are evaluated before the OS-level configuration, so this step would be premature.

• ✗

  Review the VPC Flow Logs for the instance's network interface.

  Why it's wrong here

  VPC Flow Logs record IP traffic metadata but do not provide visibility into the routing table configuration, which is the logical next step to verify internet reachability. This option is tempting because flow logs assist in diagnosing whether packets are being accepted or rejected by security groups; however, they only confirm connectivity exists rather than identifying why a route to an Internet Gateway is missing.

Go deeper

Related to this question