A SysOps administrator launches an Amazon EC2 instance in a private subnet of a VPC. When the SysOps administrator attempts a curl command from the command line of the EC2 instance, What should the…

Question

Options

• AEnsure that there is an outbound security group for port 443 to 0.0.0.0/0.
• BEnsure that there is an inbound security group for port 443 from 0.0.0.0/0.
• CEnsure that there is an outbound network ACL for ephemeral ports 1024-66535 to 0.0.0.0/0.
• DEnsure that there is an outbound network ACL for port 80 to 0.0.0.0/0.

• A
  92% (24)
• B
  4% (1)
• D
  4% (1)

Explanation

Option A is correct because security groups are stateful - when the EC2 instance initiates a curl request outbound on port 443 (HTTPS), AWS automatically allows the return traffic back in without needing a separate inbound rule. Adding the outbound rule for port 443 to 0.0.0.0/0 is all that's needed.

Why the distractors are wrong:

• B is wrong because of that same statefulness: you do not need an inbound security group rule for the response to a connection your instance initiated. Adding an inbound rule for port 443 solves nothing here.
• C is wrong because ephemeral ports (1024–65535) belong on the inbound Network ACL rule, not outbound - they're needed for response traffic returning to the instance. Network ACLs are stateless and require both directions, but this option has the direction backwards.
• D is partly directionally correct (outbound NACL) but uses port 80 (HTTP) instead of 443 (HTTPS), and more critically, a NACL fix alone requires a matching inbound ephemeral port rule too - one rule isn't enough.

Memory tip: Use the phrase "SG = Stateful, NACL = Not stateful (stateless)" - security groups track connection state so one outbound rule covers the round trip, while NACLs require explicit rules in both directions.

No community discussion yet for this question.