SCS-C02 Question 256
Select 4An organization has deployed an application in a VPC. Users are reporting that they are unable to connect to the application hosted on an EC2 instance via its public IP address. The security team suspects a network security misconfiguration. Which of the following steps should be taken to diagnose the issue?
- A
Ensure that the security group attached to the EC2 instance allows inbound traffic on the required ports.
- B
Check if the Network ACL associated with the EC2 instance's subnet allows both inbound and outbound traffic on the required ports.
- C
Verify that the EC2 instance has a public IP address assigned.
- D
Confirm that the route table associated with the subnet has a route to an Internet Gateway.
- E
Ensure that the EC2 instance is configured with the correct IAM role to allow inbound traffic.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To troubleshoot network security issues for an EC2 instance, you need to verify multiple components: security groups, Network ACLs, public IP association, and route table configuration. All these elements must be correctly configured for the instance to be accessible from the internet. IAM roles, however, are unrelated to network traffic and do not affect connectivity in this scenario.
- A. Correct.
Correct. A security group acts as a virtual firewall. If it does not allow inbound traffic on the required ports (e.g., port 80 for HTTP), external users will not be able to connect to the instance.
- B. Correct.
Correct. Network ACLs control traffic at the subnet level. If the ACL denies inbound or outbound traffic on the necessary ports, connectivity will fail.
- C. Correct.
Correct. A public IP address is necessary for external users to access the instance over the internet. Without it, the instance cannot be accessed directly.
- D. Correct.
Correct. The route table must have a route directing traffic to an Internet Gateway for the instance to be accessible from the internet.
- E. Incorrect.
Incorrect. IAM roles control permissions for accessing AWS services, not inbound network traffic to the instance. This does not apply to network-level security troubleshooting.