AWS Solutions Architect Associate Practice Test

What could prevent two EC2 instances in different subnets from pinging each other?

1. No route in subnet’s routing table

2. Inbound ICMP rules in security groups

3. Permissions in IAM roles

4. Outbound rules in NACL

The correct answer is: No route in subnet’s routing table

The reason for the correct choice relates to how routing works within AWS's VPC architecture. If there is no route in the subnet's routing table, communication between the two EC2 instances will not be possible. Each subnet has a routing table that dictates where traffic can be sent. If the routes do not allow traffic to go from one subnet to another, then there's no path for the packets to traverse, preventing the instances from establishing a connection. While inbound ICMP rules in security groups could restrict the ability to ping if they are not set to allow ICMP traffic, a missing route in the routing table would take precedence as the fundamental reason for the inability to communicate. Additionally, IAM roles relate to permissions within AWS and do not directly influence networking capabilities at the level of EC2 instance connectivity. As for outbound rules in Network ACLs, though they can also restrict traffic, the absence of a route is the primary barrier that would prevent communication altogether regardless of the permissions set at the security group or NACL levels. Therefore, the absence of a route in the subnet's routing table is the definitive reason that would prevent two EC2 instances in different subnets from pinging each other.