A company has migrated a web application to an Amazon EC2 instance in a VPC. The instance … — AWS Certified SysOps Administrator - Associate

A company has migrated a web application to an Amazon EC2 instance in a VPC. The instance is assigned a public IPv4 address and is placed in a subnet with a CIDR block of $172.16.1.0/24$ . The security group associated with the instance allows all inbound traffic on port $80$ and port $443$ , and the network ACL allows all inbound and outbound traffic. However, users are reporting that they receive connection timeouts when trying to access the application. The SysOps Administrator confirms that the application is running locally on the instance. Which of the following troubleshooting steps should the administrator perform next to resolve the connectivity issue?

Configure a route for $0.0.0.0/0$ targeting an Internet Gateway (igw-xxxxxx) in the route table associated with the subnet.Answer
B
Modify the network ACL to allow outbound traffic on ephemeral ports $1024-65535$ back to the client.
C
Associate a Gateway VPC Endpoint for the web application's subnet route tables to direct the traffic.
D
Update the Target Group health check path to point to a static file on the EC2 instance instead of the root directory.

Answer

Configure a route for

0.0.0.0/0

targeting an Internet Gateway (igw-xxxxxx) in the route table associated with the subnet.

For an EC2 instance in a VPC to be reachable from the internet, it must have a public IPv4 address and its subnet's route table must route internet-bound traffic (

0.0.0.0/0

) to an Internet Gateway. Although the security group and network ACL are configured correctly, the absence of this route prevents response packets from leaving the VPC, causing connection timeouts for external users.

Step-by-Step Solution

Analyze the network configuration: the instance has a public IP, and both security groups and network ACLs are configured to allow HTTP and HTTPS traffic.

Since security group and network ACL rules are permissive, traffic filtering is not the cause of the connection timeout.

This isolates the problem to the routing configuration rather than firewall rules.

Examine the route table associated with the subnet of the EC2 instance to check for an outbound route to the internet.

Identify that the subnet does not have a route directing traffic destination

0.0.0.0/0

to the VPC's Internet Gateway.

An instance in a public subnet cannot communicate with the internet without a default route pointing to an Internet Gateway.

Add a route in the subnet's route table for destination

0.0.0.0/0

with the target set to the Internet Gateway.

The routing path is established, enabling the instance to reply to incoming internet traffic.

This configuration makes the subnet a public subnet, enabling bidirectionally successful connectivity.

Key Concept

VPC Route Table Configuration and Internet Gateway Association

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic