ExamPark
Course menuSCS-C03

Exams / SCS-C03 / Security groups, network ACLs, Network Firewall and DNS Firewall / Question 1

SCS-C03 practice question: Security groups, network ACLs, Network Firewall and DNS Firewall

Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A SaaS company hosts its public API servers in a public subnet. Clients on the internet connect over HTTPS on port 443.

The security team uses a network ACL on that subnet that allows only inbound 443 and outbound 443. The security group allows inbound 443 from anywhere.

Since the network ACL change, some clients connect, send their request, and then time out waiting for a reply. The security team must keep the network ACL as a restrictive layer that allows only the ports the service needs, and the fix should change as little as possible.

Which change should the team make?

Choose one answer.

  1. A. Add an outbound network ACL rule allowing TCP ports 1024 to 65535, so that server replies reach the clients. Leave the security group unchanged.
  2. B. Open all inbound ports in the security group, since the clients time out and the security group must be blocking their traffic.
  3. C. Add an inbound network ACL rule for the ephemeral ports, so that the clients' replies can come back into the subnet.
  4. D. Replace the network ACL with one that allows all traffic in both directions, so that the subnet relies on the security group alone.
Show the answer and explanation

Answer: A

  • A. Right: Correct. Network ACLs are stateless, so the server replies need their own outbound rule for the ephemeral ports. The security group is stateful and already allows the replies for the connections it admitted, so it needs no change. Learn more: Network ACLs (opens in a new tab)
  • B. Wrong: The security group already allows the inbound request, because the requests reach the servers. The timeout comes from the reply leaving the subnet, so opening inbound ports changes nothing.
  • C. Wrong: The clients' replies are not the problem, because they arrive on the inbound rules that already work. The server replies are outbound traffic, so an inbound ephemeral rule would widen access without fixing the timeout.
  • D. Wrong: This fixes the timeout, but it removes the restrictive layer that the team must keep. It also allows every port, not only the ports that the service needs.

Explanation

Network ACLs are stateless, so return traffic on ephemeral ports needs its own outbound rule. Security groups are stateful and need no change for replies to already-admitted connections. Opening inbound ports, adding an inbound rule or removing the network ACL each miss the stated constraints.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SCS-C03 practice examPractice Security groups, network ACLs, Network Firewall and DNS FirewallAll Security groups, network ACLs, Network Firewall and DNS Firewall questions

Want more on Security groups, network ACLs, Network Firewall and DNS Firewall? The 5 full-length practice sets have 5 more Security groups, network ACLs, Network Firewall and DNS Firewall questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets