AWS Certified Developer Associate · Free Practice Question Medium
Question 16
A junior developer has been asked to configure access to an Amazon EC2 instance hosting a web application. The developer has configured a new security group to permit incoming HTTP traffic from 0.0.0.0/0 and retained any default outbound rules. A custom Network Access Control List (NACL) connected with the instance's subnet is configured to permit incoming HTTP traffic from 0.0.0.0/0 and retained any default outbound rules.
Which of the following solutions would you suggest if the EC2 instance needs to accept and respond to requests from the internet?
-
A
An outbound rule must be added to the Network ACL (NACL) to allow the response to be sent to the client on the ephemeral port range
-
B
Outbound rules need to be configured both on the security group and on the NACL for sending responses to the Internet Gateway
-
C
An outbound rule on the security group has to be configured, to allow the response to be sent to the client on the HTTP port
-
D
The configuration is complete on the EC2 instance for accepting and responding to requests
Reveal correct answer
Correct answer: A
Explanation
Correct option:
An outbound rule must be added to the Network ACL (NACL) to allow the response to be sent to the client on the ephemeral port range
Security groups are stateful, so allowing inbound traffic to the necessary ports enables the connection. Network ACLs are stateless, so you must allow both inbound and outbound traffic. By default, each custom Network ACL denies all inbound and outbound traffic until you add rules.
To enable the connection to a service running on an instance, the associated network ACL must allow both: 1. Inbound traffic on the port that the service is listening on 2. Outbound traffic to ephemeral ports
When a client connects to a server, a random port from the ephemeral port range (1024-65535) becomes the client's source port.
The designated ephemeral port becomes the destination port for return traffic from the service. Outbound traffic to the ephemeral port must be allowed in the network ACL.
Incorrect options:
The configuration is complete on the EC2 instance for accepting and responding to requests - As explained above, this is an incorrect statement.
An outbound rule on the security group has to be configured, to allow the response to be sent to the client on the HTTP port - Security groups are stateful. Therefore you don't need a rule that allows responses to inbound traffic.
Outbound rules need to be configured both on the security group and on the NACL for sending responses to the Internet Gateway* - Security Groups are stateful. Hence, return traffic is automatically allowed, so there is no need to configure an outbound rule on the security group.
References:
https://aws.amazon.com/premiumsupport/knowledge-center/resolve-connection-sg-acl-inbound/
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#nacl-ephemeral-ports
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
