Network ACLs overview in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

How do Network ACLs control traffic in AWS?

Network ACLs in AWS control traffic at which level?

A At the internet gateway level, filtering traffic to the internet

B At the instance level, filtering traffic to individual EC2 instances

C At the subnet level, filtering traffic entering and leaving subnets

D At the VPC level, filtering traffic between VPCs

💡 Hint

Think about where Network ACLs are applied in the network structure.

Network ACLs are stateless filters applied at the subnet level to control inbound and outbound traffic.

❓ service_behavior

intermediate

What happens if a Network ACL rule denies traffic?

If a Network ACL rule explicitly denies traffic, what is the result?

A The traffic is redirected to another subnet

B The traffic is allowed if a security group permits it

C The traffic is logged but still allowed

D The traffic is blocked and not allowed through the subnet

💡 Hint

Consider how deny rules affect network traffic flow.

Network ACL deny rules block traffic regardless of other permissions.

❓ Configuration

advanced

Identify the Network ACL rule that allows inbound HTTP traffic

Which Network ACL rule correctly allows inbound HTTP traffic on port 80?

AWS

Rule Number: 100
Protocol: TCP
Port Range: 80
Rule Action: Allow
Egress: No

A Rule Number: 100, Protocol: UDP, Port Range: 80, Rule Action: Allow, Egress: No

B Rule Number: 100, Protocol: TCP, Port Range: 80, Rule Action: Allow, Egress: No

C Rule Number: 100, Protocol: TCP, Port Range: 443, Rule Action: Allow, Egress: No

D Rule Number: 100, Protocol: TCP, Port Range: 80, Rule Action: Deny, Egress: No

💡 Hint

HTTP uses TCP on port 80 and the rule must allow inbound traffic.

Inbound HTTP traffic uses TCP port 80 and must be allowed by the rule with Egress set to No.

❓ security

advanced

Why should Network ACLs have both allow and deny rules explicitly defined?

What is the security reason for explicitly defining both allow and deny rules in Network ACLs?

A To ensure unwanted traffic is blocked and only specific traffic is allowed

B To speed up network traffic by allowing all traffic by default

C To automatically log all traffic passing through the subnet

D To allow traffic only during business hours

💡 Hint

Think about controlling access tightly for security.

Explicit allow and deny rules help control traffic precisely, improving security by blocking unwanted traffic.

❓ Architecture

expert

How does Network ACL statelessness affect return traffic handling?

Network ACLs are stateless. What does this mean for return traffic after an inbound request?

A Return traffic must be explicitly allowed by outbound rules in the Network ACL

B Return traffic is automatically allowed without any rules

C Return traffic is blocked by default and cannot be allowed

D Return traffic is handled by security groups, not Network ACLs

💡 Hint

Consider how stateless filters treat inbound and outbound packets separately.

Because Network ACLs are stateless, return traffic is treated as new traffic and must be allowed by outbound rules.