Network ACLs overview in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

How do Network ACLs control traffic in AWS?

Network ACLs in AWS control traffic at which level?

A At the internet gateway level, filtering traffic to the internet

B At the instance level, filtering traffic to individual EC2 instances

C At the subnet level, filtering traffic entering and leaving subnets

D At the VPC level, filtering traffic between VPCs

💡 Hint

Think about where Network ACLs are applied in the network structure.

Network ACLs are stateless filters applied at the subnet level to control inbound and outbound traffic.

❓ service_behavior

intermediate

What happens if a Network ACL rule denies traffic?

If a Network ACL rule explicitly denies traffic, what is the result?

A The traffic is redirected to another subnet

B The traffic is allowed if a security group permits it

C The traffic is logged but still allowed

D The traffic is blocked and not allowed through the subnet

💡 Hint

Consider how deny rules affect network traffic flow.

Network ACL deny rules block traffic regardless of other permissions.

❓ Configuration

advanced

Identify the Network ACL rule that allows inbound HTTP traffic

Which Network ACL rule correctly allows inbound HTTP traffic on port 80?

AWS

Rule Number: 100
Protocol: TCP
Port Range: 80
Rule Action: Allow
Egress: No

A Rule Number: 100, Protocol: UDP, Port Range: 80, Rule Action: Allow, Egress: No

B Rule Number: 100, Protocol: TCP, Port Range: 80, Rule Action: Allow, Egress: No

C Rule Number: 100, Protocol: TCP, Port Range: 443, Rule Action: Allow, Egress: No

D Rule Number: 100, Protocol: TCP, Port Range: 80, Rule Action: Deny, Egress: No

💡 Hint

HTTP uses TCP on port 80 and the rule must allow inbound traffic.

Inbound HTTP traffic uses TCP port 80 and must be allowed by the rule with Egress set to No.

❓ security

advanced

Why should Network ACLs have both allow and deny rules explicitly defined?

What is the security reason for explicitly defining both allow and deny rules in Network ACLs?

A To ensure unwanted traffic is blocked and only specific traffic is allowed

B To speed up network traffic by allowing all traffic by default

C To automatically log all traffic passing through the subnet

D To allow traffic only during business hours

💡 Hint

Think about controlling access tightly for security.

Explicit allow and deny rules help control traffic precisely, improving security by blocking unwanted traffic.

❓ Architecture

expert

How does Network ACL statelessness affect return traffic handling?

Network ACLs are stateless. What does this mean for return traffic after an inbound request?

A Return traffic must be explicitly allowed by outbound rules in the Network ACL

B Return traffic is automatically allowed without any rules

C Return traffic is blocked by default and cannot be allowed

D Return traffic is handled by security groups, not Network ACLs

💡 Hint

Consider how stateless filters treat inbound and outbound packets separately.

Because Network ACLs are stateless, return traffic is treated as new traffic and must be allowed by outbound rules.

Practice

1. What is the primary purpose of a Network ACL in AWS?

easy

A. To monitor application performance

B. To manage user permissions for AWS services

C. To store data securely in the cloud

D. To control inbound and outbound traffic at the subnet level

Solution

1. Step 1: Understand Network ACL function

   Network ACLs act as a firewall controlling traffic entering and leaving subnets.

2. Step 2: Identify correct purpose

   They specifically control inbound and outbound traffic at the subnet level, not user permissions or data storage.

3. Final Answer:

   To control inbound and outbound traffic at the subnet level -> Option D

4. Quick Check:

   Network ACL = subnet traffic control [OK]

Hint: Network ACLs control subnet traffic, not users or data [OK]

Common Mistakes:

• Confusing Network ACLs with IAM permissions
• Thinking Network ACLs store data
• Assuming Network ACLs monitor performance

2. Which of the following is the correct way to define a rule in a Network ACL?

easy

A. User name, password, access level, allow or deny

B. Instance ID, security group, IP address, allow or deny

C. Rule number, protocol, port range, source/destination, allow or deny

D. Subnet ID, route table, gateway, allow or deny

Solution

1. Step 1: Recall Network ACL rule components

   Network ACL rules include a rule number, protocol, port range, source or destination IP, and action (allow or deny).

2. Step 2: Match correct option

   Rule number, protocol, port range, source/destination, allow or deny lists these components correctly; other options mention unrelated elements like user credentials or instance IDs.

3. Final Answer:

   Rule number, protocol, port range, source/destination, allow or deny -> Option C

4. Quick Check:

   Network ACL rule = numbered protocol and ports [OK]

Hint: Network ACL rules use numbers, protocols, ports, and allow/deny [OK]

Common Mistakes:

• Mixing user credentials with ACL rules
• Confusing security groups with ACL rules
• Using subnet or route info as rule components

3. Given a Network ACL with the following rules:
Rule 100: Allow TCP port 80 from 0.0.0.0/0
Rule 110: Deny all traffic
What happens to an incoming TCP request on port 80 from IP 192.168.1.1?

medium

A. The request is allowed because rule 100 permits it

B. The request is denied because rule 110 denies all traffic

C. The request is ignored due to missing rule for port 80

D. The request causes an error in the Network ACL

Solution

1. Step 1: Understand rule evaluation order

   Network ACLs evaluate rules by ascending rule number. Rule 100 is checked before 110.

2. Step 2: Apply rules to the request

   Rule 100 allows TCP port 80 from any IP, so the request from 192.168.1.1 is allowed before rule 110 denies all.

3. Final Answer:

   The request is allowed because rule 100 permits it -> Option A

4. Quick Check:

   Lower rule number allow overrides higher deny [OK]

Hint: Rules checked in order; first match decides allow or deny [OK]

Common Mistakes:

• Assuming deny all overrides allow rules
• Ignoring rule number order
• Thinking missing rules cause errors

4. You created a Network ACL with these rules:
Rule 100: Allow inbound TCP port 22 from 10.0.0.0/16
Rule 110: Deny all inbound traffic
But SSH connections from 10.0.1.5 are failing. What is the likely problem?

medium

A. The Network ACL is stateless and missing an outbound allow rule for port 22

B. The security group attached to the instance denies SSH

C. The subnet does not have a route to the internet

D. The IP 10.0.1.5 is outside the allowed range

Solution

1. Step 1: Recall Network ACL stateless behavior

   Network ACLs are stateless, so return traffic must be explicitly allowed by outbound rules.

2. Step 2: Analyze rules and failure cause

   Inbound SSH is allowed, but if outbound port 22 is denied, the response cannot return, causing failure.

3. Final Answer:

   The Network ACL is stateless and missing an outbound allow rule for port 22 -> Option A

4. Quick Check:

   Stateless ACLs need inbound and outbound rules [OK]

Hint: Stateless ACLs need both inbound and outbound rules [OK]

Common Mistakes:

• Assuming ACLs are stateful like security groups
• Ignoring outbound rules for return traffic
• Mistaking IP range or subnet routing as cause

5. You want to block all HTTP traffic (port 80) to a subnet except from a specific IP 203.0.113.5 using Network ACLs. Which rule set achieves this?

hard

A. Rule 100: Deny TCP port 80 from 0.0.0.0/0Rule 110: Allow TCP port 80 from 203.0.113.5Rule 120: Allow all other traffic

B. Rule 100: Allow TCP port 80 from 203.0.113.5Rule 110: Deny TCP port 80 from 0.0.0.0/0Rule 120: Allow all other traffic

C. Rule 100: Allow all trafficRule 110: Deny TCP port 80 from 0.0.0.0/0

D. Rule 100: Deny all trafficRule 110: Allow TCP port 80 from 203.0.113.5

Solution

1. Step 1: Understand rule evaluation order

   Network ACLs evaluate rules by ascending number; first matching rule applies.

2. Step 2: Analyze rules for desired effect

   Rule 100 allows port 80 only from 203.0.113.5. Rule 110 denies port 80 from all others. Rule 120 allows other traffic.

3. Step 3: Confirm correct blocking and allowing

   This setup blocks HTTP except from the specific IP, matching the requirement.

4. Final Answer:

   Rule 100: Allow TCP port 80 from 203.0.113.5; Rule 110: Deny TCP port 80 from 0.0.0.0/0; Rule 120: Allow all other traffic -> Option B

5. Quick Check:

   Allow specific IP first, then deny others [OK]

Hint: Allow specific IP first, then deny all others [OK]

Common Mistakes:

• Placing deny before allow for specific IP
• Not including allow for other traffic
• Assuming ACLs are stateful