A SysOps administrator has set up a new Amazon EC2 instance as a web server in a public subnet. The instance uses HTTP port 80 and HTTPS port 443. The SysOps administrator has confirmed internet…

Question

Options

• AEnsure that the inbound rules of the instance's security group allow traffic on ports 80 and 443.
• BEnsure that the outbound rules of the instance's security group allow traffic on ports 80 and 443.
• CEnsure that ephemeral ports 1024-65535 are allowed in the inbound rules of the network ACL
• DEnsure that ephemeral ports 1024-65535 are allowed in the outbound rules of the network ACL
• EEnsure that the filtering rules for any firewalls that are running on the instance allow inbound
• FEnsure that AWS WAF is turned on for the instance and is blocking web traffic.

• A
  86% (18)
• B
  5% (1)
• C
  10% (2)

Explanation

A, D, and E address the three independent layers that can block inbound web traffic even when outbound connectivity is working.

A is correct because security group inbound rules must explicitly permit ports 80 and 443 - without those rules, no browser request reaches the instance. D is correct because Network ACLs are stateless, unlike security groups. When a browser connects to port 80/443, the server's response travels back to the browser's ephemeral (high) source port; outbound NACL rules must explicitly allow 1024–65535 for that return traffic to leave. E is correct because the OS itself may be running a host-based firewall (e.g., iptables, firewalld) that blocks inbound traffic independently of AWS-level controls.

B is wrong because security groups are stateful - allowing inbound on 80/443 automatically permits the corresponding return traffic, making an explicit outbound rule for those ports unnecessary. C is wrong because inbound ephemeral port rules on the NACL matter for outbound-initiated connections (like the OS update downloads, which already work) - they are not the missing piece for inbound browser access. F is wrong because AWS WAF is an optional add-on that is not enabled by default; the question's framing ("turned on and blocking") would make the problem worse, not fix it.

Memory tip: Think of the traffic path in layers - Security Group (stateful, check inbound), NACL (stateless, check both directions; responses leave on ephemeral ports), then OS firewall. The working OS updates tell you outbound and inbound ephemeral NACL rules are fine, so focus on what's missing for inbound web traffic.

No community discussion yet for this question.