SOA-C02 Deployment, Provisioning, and Automation Practice Question
Network Topology
A SysOps administrator wants to automate the deployment of an application to an EC2 instance. The instance is running, but the deployment script fails because the instance is not reachable via SSH. The administrator checks the instance state as shown in the exhibit. What should the administrator check NEXT to troubleshoot the SSH connectivity issue?
⚠ Common exam trap
SOA-C02 often tests the instinct to jump to subnet/IGW checks — the trap is overlooking that security groups are the first and most common blocker for SSH, and candidates pick the 'network architecture' answer when the simpler firewall rule check is correct.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the security group rules to ensure SSH (port 22) is allowed from the administrator's IP.
When an EC2 instance is running but SSH is unreachable, the most common cause is that the security group does not permit inbound TCP/22 from the administrator's source IP. Security groups are stateful virtual firewalls evaluated before traffic reaches the instance, so a missing or overly restrictive SSH rule silently drops the connection attempt. Checking the security group's inbound rules is the correct next troubleshooting step after confirming the instance is running.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the security group rules to ensure SSH (port 22) is allowed from the administrator's IP.
Why this is correct
Security groups act as a stateful virtual firewall at the instance level. If no inbound rule permits TCP 22 from your public IP address, all SSH packets are silently dropped, causing the connection to time out even when the instance is running, has a public IP, and is in a public subnet. The correct remediation is to add a rule that allows SSH (port 22) from your specific IP or CIDR block.
- ✗
Verify the instance is in a public subnet with an internet gateway.
Why it's wrong here
A public subnet with an internet gateway is required for direct internet-facing SSH, but if the instance were not in such a setup, you would also have no way to even initiate a remote session from your current network. Because the instance is running and you are trying to SSH from the internet, the routing and subnet configuration are already functional; otherwise you would not have a reachable public IP or would be using a different connectivity path. Thus, this is not the cause of an SSH timeout.
- ✗
Verify the instance ID is correct.
Why it's wrong here
The instance ID is simply an identifier for your API and CLI calls. If you had supplied a bad ID, the EC2 console or describe-instances API would return an error like 'InvalidInstanceID.NotFound', whereas your problem is a network connection timeout, not a client-side lookup failure. Since you are able to view the instance details and state, the ID referenced is correct.
- ✗
Check if the instance is in a stopped state.
Why it's wrong here
A stopped instance (code 80) has no running kernel or network stack, so it cannot respond to TCP handshakes; however, the instance's state is running (code 16) according to the EC2 status output. Checking for a stopped state is therefore unnecessary here. Even when an instance is in the running state, networking components like security groups or NACLs can still block SSH.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.