ANS-C01 · Question #72
You deploy an Amazon EC2 instance that runs a web server into a subnet in a VPC. An Internet gateway is attached, and the main route table has a default route (0.0.0.0/0) configured with a target of…
The correct answer is D. Add an entry to the Network ACL outbound rules for Protocol: TCP, Port Range: 1024-65535. To enable the connection to a service running on an instance, the associated network ACL must allow both inbound traffic on the port that the service is listening on as well as allow outbound traffic from ephemeral ports. When a client connects to a server, a random port from…
Question
You deploy an Amazon EC2 instance that runs a web server into a subnet in a VPC. An Internet gateway is attached, and the main route table has a default route (0.0.0.0/0) configured with a target of the Internet gateway. The instance has a security group configured to allow as follows:
Protocol: TCP Port: 80 inbound, nothing outbound The Network ACL for the subnet is configured to allow as follows:
Protocol: TCP Port: 80 inbound, nothing outbound When you try to browse to the web server, you receive no response. Which additional step should you take to receive a successful response?
Options
- AAdd an entry to the security group outbound rules for Protocol: TCP, Port Range: 80
- BAdd an entry to the security group outbound rules for Protocol: TCP, Port Range: 1024-65535
- CAdd an entry to the Network ACL outbound rules for Protocol: TCP, Port Range: 80
- DAdd an entry to the Network ACL outbound rules for Protocol: TCP, Port Range: 1024-65535
How the community answered
(31 responses)- A16% (5)
- B6% (2)
- C10% (3)
- D68% (21)
Explanation
To enable the connection to a service running on an instance, the associated network ACL must allow both inbound traffic on the port that the service is listening on as well as allow outbound traffic from ephemeral ports. When a client connects to a server, a random port from the ephemeral port range (1024-65535) becomes the client's source port. The designated ephemeral port then becomes the destination port for return traffic from the service, so outbound traffic from the ephemeral port must be allowed in the network ACL. https://aws.amazon.com/premiumsupport/knowledge-center/resolve-connection-sg-acl-inbound/
Topics
Community Discussion
No community discussion yet for this question.