A user is connected to an Amazon EC2 instance in a private subnet. The user is unable to access A SysOps administrator reviews the VPC configuration and learns the following information: - The…

Question

Options

• AAdd an additional inbound network ACL rule for port 80 to CIDR 0.0.0.0/0.
• BAdd an additional inbound security group rule for port 80 to CIDR 0.0.0.0/0.
• CAdd an additional outbound security group rule for port 80 to CIDR 0.0.0.0/0.
• DAdd an additional outbound security group rule for port 80 to the user's IP address.

• A
  3% (1)
• B
  3% (1)
• C
  84% (26)
• D
  10% (3)

Explanation

Option C is correct because curl uses HTTP on port 80 by default, and the EC2 instance's outbound security group only permits port 443 - blocking the outbound request before it even reaches the NAT gateway. Adding an outbound rule for port 80 to 0.0.0.0/0 allows the instance to initiate that connection.

Why the distractors fail:

• A is wrong because the inbound network ACL already covers ephemeral/return-traffic ports (1024–65535), so return traffic from a curl request is already permitted. Adding inbound port 80 to the NACL would only help if something external were trying to reach the instance on port 80.
• B is wrong because inbound security group rules control traffic arriving at the instance - they have no effect on outbound requests the instance initiates.
• D is wrong because the curl request is going to an external website, not back to the user's IP; scoping the rule to the user's IP makes no sense for outbound internet traffic.

Memory tip: Think of the traffic flow in two legs - outbound (EC2 → NAT → internet) and inbound return (internet → NAT → EC2). Security groups are stateful (return traffic is automatic), so you only need to fix the outbound rule. NACLs are stateless, so both directions need explicit rules - but the return path (ephemeral ports 1024–65535) was already covered, leaving the outbound security group as the sole gap.

No community discussion yet for this question.