An application running on EC2 instances in a VPC must call an external web service via TLS (port 443). The instances run in public subnets. Which configurations below allow the application to…

Question

Options

• AA network ACL with a rule that allows outgoing traffic on port 443.
• BA network ACL with rules that allow outgoing traffic on port 443 and incoming traffic on ephemeral
• CA network ACL with rules that allow outgoing traffic on port 443 and incoming traffic on port 443.
• DA security group with a rule that allows outgoing traffic on port 443
• EA security group with rules that allow outgoing traffic on port 443 and incoming traffic on
• FA security group with rules that allow outgoing traffic on port 443 and incoming traffic on port 443.

• A
  2% (1)
• B
  77% (34)
• C
  5% (2)
• E
  14% (6)
• F
  2% (1)

Explanation

Since here the traffic needs to flow outbound from the Instance to a web service on Port 443, the outbound rules on both the Network and Security Groups need to allow outbound traffic. The Incoming traffic should be allowed on ephermal ports for the Operating System on the Instance to allow a connection to be established on any desired or available port. Option A is invalid because this rule alone is not enough. You also need to ensure incoming traffic on ephemeral ports Option C is invalid because need to ensure incoming traffic on ephemeral ports and not only port Option E and F are invalid since here you are allowing additional ports on Security groups which are not required https://docs.aws.amazon.com/AmazonVPC/latest/UserGuideA/PC_SecurityGroups.html

No community discussion yet for this question.