You have an EC2 instance with the following security configured:

Question

Options

• AAn ACCEPT record for the request based on the Security Group
• BAn ACCEPT record for the request based on the NACL
• CA REJECT record for the response based on the Security Group
• DA REJECT record for the response based on the NACL

• A
  70% (26)
• C
  30% (11)

Explanation

This example is given in the AWS documentation as well For example, you use the ping command from your home computer (IP address is 203.0.113.12) to your instance (the network interface's private IP address is 172.31.16.139). Your security group's inbound rules allow ICMP traffic and the outbound rules do not allow ICMP traffic however, because security groups are stateful, the response ping from your instance is allowed. Your network ACL permits inbound ICMP traffic but does not permit outbound ICMP traffic. Because network ACLs are stateless, the response ping is dropped and will not reach your home computer. In a flow log, this is displayed as 2 flow log records: An ACCEPT record for the originating ping that was allowed by both the network ACL and the security group, and therefore was allowed to reach your instance. A REJECT record for the response ping that the network ACL denied. Option C is invalid because the REJECT record would not be present

No community discussion yet for this question.