AWS - Security Groups and Network ACLs
If a Security Group allows outbound traffic on port 443 but the Network ACL denies outbound traffic on all ports, what is the effective behavior for outbound HTTPS requests?
If a Security Group allows outbound traffic on port 443 but the Network ACL denies outbound traffic on all ports, what is the effective behavior for outbound HTTPS requests?
medium📝 Predict Output Q5 of 15
Step-by-Step Solution
Solution:
Step 1: Analyze Network ACL outbound rules
Network ACL denies all outbound traffic, so no outbound packets leave the subnet.Step 2: Analyze Security Group outbound rules
Security Group allows outbound HTTPS, but cannot override subnet-level deny.Final Answer:
Outbound HTTPS requests are blocked by the Network ACL -> Option AQuick Check:
Subnet-level deny blocks outbound despite Security Group allow [OK]
Quick Trick: NACL deny blocks traffic even if Security Group allows [OK]
Common Mistakes:
MISTAKES- Assuming Security Group outbound rules override NACL
- Confusing subnet type with traffic filtering
- Ignoring stateless nature of NACLs
Master "Security Groups and Network ACLs" in AWS
Want More Practice?
15+ quiz questions · All difficulty levels · Free
Free Signup - Practice All QuestionsMore AWS Quizzes