An operations team has deployed an application server on an Amazon EC2 instance in a newly configured subnet within a VPC. The instance is assigned a public IP address, and its security group is configured to allow all outbound traffic. However, the server cannot connect to any external internet resources.
Which two troubleshooting steps should a SysOps Administrator perform to identify the root cause of this connectivity issue? (Select TWO.)
- Verify that the subnet's route table contains a route for targeting the VPC's Internet Gateway (IGW).Answer
- Confirm that the subnet's network ACL inbound rules allow response traffic from the internet on ephemeral ports (-).Answer
- CVerify that the instance's security group has an inbound rule allowing return traffic on ephemeral ports (-).
- DVerify that the subnet's route table contains a route for targeting a Virtual Private Gateway (VGW) attached to the VPC.
- EConfigure a Gateway VPC endpoint for internet-bound traffic and verify that it is associated with the subnet's route table.
Answer
The correct troubleshooting steps are to verify that the subnet's route table contains a route for targeting the VPC's Internet Gateway (IGW), and to confirm that the subnet's network ACL inbound rules allow response traffic from the internet on ephemeral ports (-).
For an EC2 instance to connect to the internet directly, it must reside in a public subnet. A subnet is public if its route table has a route for pointing to an Internet Gateway (IGW). Additionally, because network ACLs are stateless, they evaluate inbound and outbound traffic independently. When an instance initiates an outbound connection (e.g., HTTP/HTTPS), the response from the server returns on a random ephemeral port (-). Thus, the inbound network ACL rules must allow traffic on these ephemeral ports for the connection to succeed.
Step-by-Step Solution
Key Concept
Troubleshooting internet connectivity for EC2 instances in a public subnet by validating route tables and stateless Network ACL rules.