Stateless behavior of NACLs in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Stateless Nature of NACLs

Network Access Control Lists (NACLs) in AWS are stateless. What does this mean for the traffic flow?

A NACLs automatically allow return traffic without explicit rules.

B NACLs block all traffic by default and cannot be modified.

C NACLs maintain session state to track connections.

D NACLs require explicit inbound and outbound rules for traffic to flow both ways.

💡 Hint

Think about how a stateless firewall treats incoming and outgoing packets separately.

Because NACLs are stateless, they do not remember previous traffic. This means you must create rules for both inbound and outbound traffic explicitly to allow communication.

❓ service_behavior

intermediate

Effect of Missing Outbound Rule in NACL

You have a NACL with an inbound rule allowing HTTP (port 80) traffic. There is no outbound rule allowing return traffic. What will happen when a client tries to access a web server behind this NACL?

A The client will connect but will not receive any response.

B The client will successfully connect and receive responses.

C The client connection will be blocked at the inbound rule.

D The NACL will automatically allow outbound return traffic.

💡 Hint

Remember that NACLs are stateless and require explicit outbound rules.

Since there is no outbound rule allowing the return traffic, the response packets from the server are blocked, so the client will not receive any response.

❓ Configuration

advanced

NACL Rules for Bidirectional SSH Access

You want to configure a NACL to allow SSH (port 22) access to an EC2 instance and allow the instance to respond back. Which set of rules correctly achieves this?

A Inbound: Allow TCP port 22; Outbound: Allow TCP port 22

B Inbound: Allow ephemeral ports (1024-65535); Outbound: Allow TCP port 22

C Inbound: Allow TCP port 22; Outbound: Allow ephemeral ports (1024-65535)

D Inbound: Allow all traffic; Outbound: Deny all traffic

💡 Hint

Think about how return traffic uses ephemeral ports.

Inbound SSH traffic arrives on port 22, but return traffic from the instance uses ephemeral ports. So inbound rules allow port 22, outbound rules allow ephemeral ports.

❓ security

advanced

Security Implication of Stateless NACLs

What is a key security implication of NACLs being stateless compared to security groups which are stateful?

A NACLs require explicit rules for both directions, increasing rule complexity and risk of misconfiguration.

B NACLs automatically block all return traffic, increasing security.

C NACLs track connection state, reducing the need for outbound rules.

D NACLs cannot be used to block specific IP addresses.

💡 Hint

Consider how statelessness affects rule management.

Because NACLs do not track connection state, you must create rules for both inbound and outbound traffic. This can increase complexity and risk of mistakes.

❓ Architecture

expert

Designing a Highly Available NACL Setup

You need to design a highly available architecture using multiple subnets in different Availability Zones (AZs) with NACLs. Which statement about NACLs is true in this scenario?

A Each subnet must have a unique NACL; sharing NACLs across subnets is not allowed.

B A single NACL can be associated with multiple subnets across AZs to simplify management.

C NACLs are regional and automatically replicate rules across AZs.

D NACLs are stateful and automatically handle failover between AZs.

💡 Hint

Think about how NACLs associate with subnets and their scope.

A single NACL can be associated with multiple subnets, even across different AZs, which helps simplify rule management in multi-AZ architectures.