AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 48
A company is connected to an Amazon VPC from an on-premises data center with a VPN connection. A SysOps Administrator attempted to ping an Amazon EC2 instance in a private subnet with the IP 172.31.10.10 and did not receive a response. The ping command was issued from a computer in the data center with the IP address 3.104.75.244. VPC Flow Logs were enabled and showed the following entries:
2 123456789010 eni-1234abcd 3.104.75.244 172.31.10.10 0 0 1 4 336 1432917027 1432917142 ACCEPT OK
2 123456789010 eni-1234abcd 172.31.10.10 3.104.75.244 0 0 1 4 336 1432917094 1432917142 REJECT OK
What is the most likely cause of the issue?
-
A
The EC2 security group rules need to be modified to allow inbound traffic from the on-premises computer.
-
B
The EC2 security group rules need to be modified to allow outbound traffic to the on-premises computer.
-
C
The network ACL rules need to be modified to allow outbound traffic to the on-premises computer.
-
D
The network ACL rules need to be modified to allow inbound traffic from the on-premises computer.
Reveal correct answer
Correct answer: C
Explanation
The VPC Flow Log entries show that the inbound connection is accepted and should therefore reach the destination but the outbound connection from the instance to the on-premises computer (172.31.10.10 -> 3.104.75.244 0) was rejected. Security groups are stateful so would allow any return traffic for connections that were accepted inbound. However, Network ACLs are stateless so there must be an entry to allow inbound traffic and an entry to allow the outbound return traffic. In this case it looks like the Network ACL is not configured with the rule to allow the outbound return traffic.
The following diagram shows the packets for a connection to a web server and the response from the web server with source and destination ports. Note the comments about the difference between stateful and stateless firewalls.
CORRECT: "The network ACL rules need to be modified to allow outbound traffic to the on-premises computer" is the correct answer.
INCORRECT: "The EC2 security group rules need to be modified to allow inbound traffic from the on-premises computer" is incorrect. The inbound connection was accepted so this is unlikely to be the issue.
INCORRECT: "The EC2 security group rules need to be modified to allow outbound traffic to the on-premises computer" is incorrect. Security groups are stateful and will automatically allow the return traffic.
INCORRECT: "The network ACL rules need to be modified to allow inbound traffic from the on-premises computer" is incorrect. The inbound connection was accepted so this is unlikely to be the issue.
References:
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
