What steps should you take to identify the source of the behavior?

A and C

AC

Sivakamur,

I cant see any indication anywhere why d will be right. In order to connect to instance IAM roles while creating instance is not necessary. IAM role while creating the instance is used if your instance needs to interact with other aws services.

and you are absolutely right about C as well. In that case i consider there is no second answer.

However

Error connecting to your instance: Connection timed out

If you try to connect to your instance and get an error message Network error: Connection timed out or Error connecting to [instance], reason: -> Connection timed out: connect, try the following:

Check your security group rules. You need a security group rule that allows inbound traffic from your public IP address on the proper port.
Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
In the navigation pane, choose Instances, and then select your instance.
In the Description tab, next to Security groups, choose view rules to display the list of rules that are in effect.
For Linux instances: Verify that there is a rule that allows traffic from your computer to port 22 (SSH).
For Windows instances: Verify that there is a rule that allows traffic from your computer to port 3389 (RDP).
If your security group has a rule that allows inbound traffic from a single IP address, this address may not be static if your computer is on a corporate network or if you are connecting through an Internet service provider (ISP). Instead, specify the range of IP addresses used by client computers. If your security group does not have a rule that allows inbound traffic as described in the previous step, add a rule to your security group. For more information, see Authorizing Network Access to Your Instances.
[EC2-VPC] Check the route table for the subnet. You need a route that sends all traffic destined outside the VPC (0.0.0.0/0) to the Internet gateway for the VPC.
Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
In the Description tab, write down the values of VPC ID and Subnet ID.
Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
In the navigation pane, choose Internet Gateways. Verify that there is an Internet gateway attached to your VPC. Otherwise, choose Create Internet Gateway and follow the directions to create an Internet gateway, select the Internet gateway, and then choose Attach to VPC and follow the directions to attach it to your VPC.
In the navigation pane, choose Subnets, and then select your subnet.
On the Route Table tab, verify that there is a route with 0.0.0.0/0 as the destination and the Internet gateway for your VPC as the target. Otherwise, choose the ID of the route table (rtb-xxxxxxxx) to navigate to the Routes tab for the route table, choose Edit, Add another route, enter 0.0.0.0/0 in Destination, select your Internet gateway from Target, and then choose Save.
[EC2-VPC] Check the network access control list (ACL) for the subnet. The network ACLs must allow inbound and outbound traffic from your public IP address on the proper port. The default network ACL allows all inbound and outbound traffic.
Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
In the navigation pane, choose Your VPCs.
On the Summary tab, find Network ACL, choose the ID (acl-xxxxxxxx), and select the ACL.
On the Inbound Rules tab, verify that the rules allow traffic from your computer. Otherwise, delete or modify the rule that is blocking traffic from your computer.
On the Outbound Rules tab, verify that the rules allow traffic to your computer. Otherwise, delete or modify the rule that is blocking traffic to your computer.
If your computer is on a corporate network, ask your network administrator whether the internal firewall allows inbound and outbound traffic from your computer on port 22 (for Linux instances) or port 3389 (for Windows instances).
If you have a firewall on your computer, verify that it allows inbound and outbound traffic from your computer on port 22 (for Linux instances) or port 3389 (for Windows instances).
Check that your instance has a public IP address. If not, you can associate an Elastic IP address with your instance. For more information, see Elastic IP Addresses.
Check the CPU load on your instance; the server may be overloaded. AWS automatically provides data such as Amazon CloudWatch metrics and instance status, which you can use to see how much CPU load is on your instance and, if necessary, adjust how your loads are handled. For more information, see Monitoring Your Instances Using CloudWatch.
If your load is variable, you can automatically scale your instances up or down using Auto Scaling and Elastic Load Balancing.
If your load is steadily growing, you can move to a larger instance type. For more information, see Resizing Your Instance.

B and E
Here goes my somewhat meaningful theory
Just open your putty type a random IP and click open, You will get the error mentioned in the question “Network error: Connection timed out” think carefully this is not a permission denied error or wrong user related error so A and C are wrong answers.

why u get above error is when that instance itself doesn’t exist or not launched properly.
Answer D is wrong IAM role is nothing to do with launching or connecting an instance(Tell me if i am wrong).

so the user got wrong policy given to him which caused to failure of the instance launch properly.

But if the user is a federated user may be some trust related permission should be given to launch instance properly not sure on this.

since i eliminated A,C,D i am choosing B and E.
If anybody still think A and C are right, Can u explain it with ur theory that how u will get Network error: Connection timed out” error by using wrong key\user.

B and D

I agree with LazyGuy,A and C are wrong answers.

Source: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.html
if A and C, there will be other error message, like “Error: User key not recognized by server”, “Error: Host key not found, Permission denied (publickey), or Authentication failed, permission denied” etc.

E. federation trust to AWS is not needed.

Since its a network timeout and the network configuration is in place, it can only mean the instance isnt running.

So B and D

AC
IAM role used to communicate with other AWS service like s3 when it is up and running, the problem is Network error so it may be related to key pair or IMG user (ubuntu, root and ec2)

this is network timeout and permissions are set correctly so

B – instance is not started so timeout

D – role used to by the instance is preventing you to ssh

I go for B and D

Timeout is always connected to blocking on a firewall,so it must be a security group or network ACL.If private key is wrong , there should be this response:
[root@ip-10-0-1-32 ec2-user]# ssh -i vpc2.pem [email protected]
Permission denied (publickey).
I think somebody making this question messed the response.

Verify that the private key file corresponds to the Amazon EC2 key pair assigned at launch.

Verify that your IAM user policy has permission to launch Amazon EC2 instances. (there is not need for a IAM user and just need ssh keys)

Verify that you are connecting with the appropriate user name for your AMI. (Although it gives different error seems the only other logical choice)

Verify that the Amazon EC2 Instance was launched with the proper IAM role. (role assigned to EC2 is irrelevant for ssh and only controls what AWS resources EC2 can access to)

Verify that your federation trust to AWS has been established (federation is for authenticating the user)

A and C are the right answers

The question shall be “Error: User key not recognized by server”, then A and C is correct answer.
Check this page with this error message section:
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.html#TroubleshootingInstancesConnectionTimeout
Error: User key not recognized by server
If you use SSH to connect to your instance