A company runs multiple applications on Amazon EC2 instances in a VPC. Application A runs in a private subnet that has a custom route table and network ACL. Application B runs in a second private…

Question

Options

• AAdd a deny outbound rule to a security group that is associated with Application B. Configure the
• BAdd a deny outbound rule to a security group that is associated with Application A. Configure the
• CAdd a deny outbound rule to the custom network ACL for the Application B subnet. Configure the
• DAdd a deny outbound rule to the custom network ACL for the Application A subnet. Configure the

• A
  5% (3)
• B
  4% (2)
• C
  7% (4)
• D
  84% (47)

Explanation

Security groups are stateful, but they cannot explicitly deny traffic - only allow. Network ACLs are stateless and support explicit deny rules. To prevent Application A from sending traffic to Application B, configure a deny outbound rule in the network ACL of Application A's subnet to block traffic to Application B's subnet. "Unlike security groups, network ACLs support both allow and deny rules, enabling you to explicitly block traffic." This is the correct method to block outbound traffic between subnets.

No community discussion yet for this question.