You must add an Amazon Web Services (AWS) network access list (NACL) rule to allow SSH traffic to a subnet for temporary testing purposes. When you review the current inbound and outbound NACL…

Question

Options

• AYou do not have to create any NACL rules because the default security group rule automatically
• BYou must create a new allow SSH rule anywhere in the network ACL rule base to allow SSH
• CYou must create two new allow SSH rules, each with a number bigger than 5.
• DYou must create two new allow SSH rules, each with a number smaller than 5.

• A
  3% (2)
• B
  7% (4)
• C
  14% (8)
• D
  76% (44)

Explanation

Option D is correct because AWS NACLs evaluate rules in ascending numerical order, stopping at the first match. Since rule #5 currently denies SSH, any allow rule must carry a number lower than 5 to be evaluated first and take effect. Two rules are required because NACLs are stateless - unlike security groups, they don't automatically allow return traffic, so you need one inbound rule (allow SSH on port 22) and one outbound rule (allow ephemeral/return ports).

Why the others are wrong:

• A is wrong because security groups and NACLs are independent layers; default security group behavior cannot override an explicit NACL deny rule.
• B is wrong because placement is not arbitrary - a rule placed after rule #5 (e.g., rule #10) will never be reached, since rule #5 already matched and terminated evaluation.
• C is wrong for the same reason: rules numbered higher than 5 are evaluated after the deny, so SSH would still be blocked.

Memory tip: Think of NACL rules as a numbered "first-match wins" checklist read top-to-bottom. To override a deny at position 5, you must cut in line with a lower number - just like getting to the front of a queue by having a lower ticket number.

No community discussion yet for this question.