AWS - Security Groups and Network ACLs
Given a subnet with a Network ACL that denies all inbound traffic except HTTP (port 80), what happens if a Security Group attached to an instance in that subnet allows SSH (port 22)?
Given a subnet with a Network ACL that denies all inbound traffic except HTTP (port 80), what happens if a Security Group attached to an instance in that subnet allows SSH (port 22)?
medium📝 Predict Output Q4 of 15
Step-by-Step Solution
Solution:
Step 1: Understand Network ACL rules precedence
Network ACLs act at subnet level and deny all inbound except HTTP, so SSH is blocked at subnet boundary.Step 2: Understand Security Group role
Security Groups allow SSH, but cannot override subnet-level Network ACL deny rules.Final Answer:
SSH traffic is blocked by the Network ACL despite Security Group allowing it -> Option DQuick Check:
Subnet-level deny overrides instance-level allow [OK]
Quick Trick: Subnet NACL deny beats Security Group allow [OK]
Common Mistakes:
- Assuming Security Group overrides NACL
- Ignoring subnet-level filtering
- Confusing route tables with security filtering
Master "Security Groups and Network ACLs" in AWS
Want More Practice?
15+ quiz questions · All difficulty levels · Free
Free Signup - Practice All QuestionsMore AWS Quizzes