SOA-C02 Networking and Content Delivery Practice Question
A SysOps administrator is troubleshooting connectivity issues between Amazon EC2 instances in two different VPCs that are connected via a VPC peering connection. The instances can successfully send ICMP (ping) traffic, but TCP connections on port 443 (HTTPS) fail. The security groups of both instances allow all inbound and outbound traffic. What is the most likely cause of the issue?
⚠ Common exam trap
Many exam-takers assume security groups are the only firewall layer, overlooking that Network ACLs are stateless and require explicit rules for ephemeral port return traffic, which is why ICMP works but TCP fails.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Network ACL associated with the subnets is blocking the return traffic for TCP connections on ephemeral ports
The Network ACL (NACL) is stateless, meaning it must explicitly allow both inbound and outbound traffic. While ICMP (ping) works because it doesn't rely on ephemeral ports for return traffic, TCP connections on port 443 require the return traffic to come from the target instance on a high ephemeral port (typically 1024-65535). If the NACL's outbound rules block these ephemeral ports, the TCP handshake fails, even though the security groups allow all traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Network ACL associated with the subnets is blocking the return traffic for TCP connections on ephemeral ports
Why this is correct
Network ACLs are stateless, so they require explicit rules for traffic in both directions. While ICMP may be permitted by the inbound/outbound rules, TCP return traffic (such as the acknowledgment and response packets) arrives on ephemeral ports (typically 1024–65535). If the outbound NACL rule does not explicitly allow these high ports, the TCP handshake or established connections will fail even though ping works. This is the classic symptom of a NACL blocking return traffic.
- ✗
The VPC peering connection is not properly configured for TCP traffic
Why it's wrong here
A VPC peering connection operates at the network layer and does not inspect or filter traffic by protocol; it simply provides connectivity between the two VPCs. If the peering connection were improperly configured, all IP traffic—including ICMP and TCP—would be affected, not just TCP on port 443. The fact that ICMP succeeds indicates the peering link itself is functional, and any TCP-only failure must be caused by a layer above the peering connection, such as routing, security groups, or NACLs.
- ✗
The route tables in the VPCs do not contain a route for the other VPC's CIDR
Why it's wrong here
Route tables in a VPC are protocol-agnostic—they direct packets based on destination CIDR, not on whether the payload is ICMP, TCP, or UDP. If the route tables in either VPC lacked the route for the other VPC's CIDR, the ICMP echo request or reply would also be dropped, since routing is required for all packet types. Because ICMP traffic is reaching the instance successfully, the route tables must contain the necessary peering routes for both directions. Therefore, missing routes cannot be the cause of a TCP-only connectivity problem.
- ✗
The security group on the EC2 instance is blocking inbound TCP traffic on port 443
Why it's wrong here
The question explicitly states that the security groups are configured to allow all inbound and outbound traffic, so a security group rule cannot be blocking inbound TCP on port 443. Even if the security group were more restrictive, security groups are stateful—return traffic for an allowed outbound connection is automatically permitted without an explicit inbound rule. Since the issue is specifically with return traffic on ephemeral ports, a stateful security group would not drop those packets, whereas a stateless NACL would. This option contradicts the given facts and the observed symptom.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.