SOA-C03 practice question: Troubleshooting VPC connectivity (1 of 2)

Networking and Content Delivery A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A regional bank placed its public web servers in a subnet with a custom network ACL. The inbound rules allow TCP 443 from 0.0.0.0/0, and the outbound rules allow TCP 443 to 0.0.0.0/0; everything else is denied. The security groups allow inbound 443. Customers' browsers time out. VPC Flow Logs show the inbound packets on port 443 as ACCEPT, and the servers' reply packets to client ports such as 51544 as REJECT. What should a CloudOps engineer change?

Choose one answer.

A. Add an outbound rule to the security group that allows TCP traffic to 0.0.0.0/0 on ports 1024 to 65535.
B. Add an outbound rule to the network ACL that allows TCP traffic to 0.0.0.0/0 on ports 1024 to 65535.
C. Add an inbound rule to the network ACL that allows TCP traffic from 0.0.0.0/0 on ports 1024 to 65535.
D. Replace the custom network ACL with a security group rule on the subnet that allows all return traffic.

Show the answer and explanation

Answer: B

A. Wrong: Security groups are stateful, so replies to allowed inbound traffic are allowed automatically. The REJECT comes from the stateless network ACL. Learn more: Control traffic to your AWS resources using security groups (opens in a new tab)
B. Right: Correct. Network ACLs are stateless, so return traffic needs its own rule. Replies go to the client's ephemeral port, which is usually between 1024 and 65535, and the current outbound rule allows only port 443. Learn more: Control subnet traffic with network access control lists (opens in a new tab)
C. Wrong: The failing packets are the outbound replies, not inbound traffic. An inbound ephemeral port rule would not let the replies leave the subnet. Learn more: Control subnet traffic with network access control lists (opens in a new tab)
D. Wrong: Security groups attach to network interfaces, not to subnets. The fix is to allow the ephemeral port range in the network ACL that is already there. Learn more: Control traffic to your AWS resources using security groups (opens in a new tab)

Explanation

Network ACLs evaluate each direction on its own. A rule that allows inbound 443 does not allow the response, which goes from port 443 to the client's ephemeral port. Flow logs that show ACCEPT inbound and REJECT for outbound replies are the classic sign, and an outbound rule for ports 1024 to 65535 fixes it.

SOA-C03 practice question: Troubleshooting VPC connectivity (1 of 2)

Explanation

Study

Keep practicing