SOA-C02 Networking and Content Delivery Practice Question
A SysOps administrator needs to allow traffic from a specific IP address range (203.0.113.0/24) to access an Amazon EC2 instance in a VPC. Which configuration step should be performed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an inbound rule to the security group associated with the EC2 instance allowing traffic from 203.0.113.0/24.
Security groups act as a virtual firewall for EC2 instances, allowing you to specify inbound rules to permit traffic from specific IP ranges like 203.0.113.0/24. Option A is incorrect because IAM policies manage permissions for AWS actions, not network traffic filtering. Option B is incorrect because network ACLs provide stateless filtering at the subnet level, but security groups are more appropriate for instance-level control and are stateful. Option C is incorrect because route tables control the direction of outbound traffic and do not restrict inbound access to instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM policy that allows inbound traffic from 203.0.113.0/24.
Why it's wrong here
IAM policies are JSON documents that grant or deny permissions to AWS API actions, such as ec2:RunInstances or s3:PutObject. They do not inspect or filter network packets, so a policy cannot allow inbound traffic to an EC2 instance. To permit traffic from a CIDR range, you must modify a network-level firewall like a security group or network ACL.
- ✗
Add a rule to the network ACL associated with the subnet to allow inbound traffic from 203.0.113.0/24.
Why it's wrong here
Network ACLs are stateless, meaning an inbound allow rule does not automatically permit the corresponding outbound response traffic. You would need to add a separate outbound rule to allow the instance's replies to return to 203.0.113.0/24. Additionally, a NACL applies to all instances in the subnet, so it lacks the instance-specific granularity that a security group provides.
- ✗
Modify the route table of the subnet to include a route for 203.0.113.0/24 to the internet gateway.
Why it's wrong here
Route tables govern the path of outbound traffic leaving a subnet by matching the destination IP address to a route target. Adding a route for 203.0.113.0/24 to an internet gateway would only affect traffic sent from the subnet to that CIDR block, not traffic arriving from that block. Inbound connections are delivered directly to the instance based on the instance's network interface and are not controlled by route table entries.
- ✓
Add an inbound rule to the security group associated with the EC2 instance allowing traffic from 203.0.113.0/24.
Why this is correct
A security group is a stateful, instance-level virtual firewall that filters traffic at the elastic network interface. Adding an inbound rule that permits 203.0.113.0/24 on the desired port allows that specific source to reach the EC2 instance, and because security groups are stateful, the return traffic is automatically allowed without any additional outbound rule. This provides the most precise and correct method for the stated requirement.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.