SCS-C02 · Question #62
While securing the connection between a company's VPC and its on-premises data center, a security engineer sent a ping command from an on-premises host (IP address 203.0.113.12) to an Amazon EC2…
The correct answer is D. In the VPC's NACL, allow outbound ICMP traffic. NACLs are stateless and do not track the state of a connection, while Security Groups are stateful and allow traffic based on the response to previous traffic. Default rule: NACLs have a default rule that denies all traffic, while Security Groups have a default rule that allows…
Question
While securing the connection between a company's VPC and its on-premises data center, a security engineer sent a ping command from an on-premises host (IP address 203.0.113.12) to an Amazon EC2 instance (IP address 172.31.16.139). The ping command did not return a response. The flow log in the VPC showed the following:
What action should be performed to allow the ping to work?
Exhibit
Options
- AIn the security group of the EC2 instance, allow inbound ICMP traffic.
- BIn the security group of the EC2 instance, allow outbound ICMP traffic.
- CIn the VPC's NACL, allow inbound ICMP traffic.
- DIn the VPC's NACL, allow outbound ICMP traffic.
How the community answered
(47 responses)- A6% (3)
- B15% (7)
- C4% (2)
- D74% (35)
Explanation
NACLs are stateless and do not track the state of a connection, while Security Groups are stateful and allow traffic based on the response to previous traffic. Default rule: NACLs have a default rule that denies all traffic, while Security Groups have a default rule that allows all traffic.
Topics
Community Discussion
No community discussion yet for this question.