Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Amazon Exam SCS-C02 Topic 6 Question 31 Discussion

Actual exam question for Amazon's SCS-C02 exam
Question #: 31
Topic #: 6
[All SCS-C02 Questions]

An AWS account that is used for development projects has a VPC that contains two subnets. The first subnet is named public-subnet-1 and has the CIDR block 192.168.1.0/24 assigned. The other subnet is named private-subnet-2 and has the CIDR block 192.168.2.0/24 assigned. Each subnet contains Amazon EC2 instances.

Each subnet is currently using the VPC's default network ACL. The security groups that the EC2 instances in these subnets use have rules that allow traffic between each instance where required. Currently, all network traffic flow is working as expected between the EC2 instances that are using these subnets.

A security engineer creates a new network ACL that is named subnet-2-NACL with default entries. The security engineer immediately configures private-subnet-2 to use the new network ACL and makes no other changes to the infrastructure. The security engineer starts to receive reports that the EC2 instances in public-subnet-1 and public-subnet-2 cannot communicate with each other.

Which combination of steps should the security engineer take to allow the EC2 instances that are running in these two subnets to communicate again? (Select TWO.)

Show Suggested Answer Hide Answer
Suggested Answer: C

Contribute your Thoughts:

Aleshia
1 months ago
I bet the security engineer is scratching their head over this one. Maybe they should consult the AWS documentation - it's the holy grail for these kinds of questions!
upvoted 0 times
Barney
7 days ago
B) Add an inbound allow rule for 192.168.1.0/24 in subnet-2-NACL.
upvoted 0 times
...
Stephaine
8 days ago
A) Add an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL.
upvoted 0 times
...
Jeanice
16 days ago
The security engineer should definitely check the AWS documentation for guidance.
upvoted 0 times
...
Frank
22 days ago
C) Add an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL.
upvoted 0 times
...
Shawnna
26 days ago
A) Add an outbound allow rule for 192.168.2.0/24 in the VPC's default network ACL.
upvoted 0 times
...
...
Deeanna
1 months ago
This is a tricky one, but I think the security engineer should go with C and D. Gotta love those network ACL shenanigans!
upvoted 0 times
...
Rashad
2 months ago
Haha, this question is a classic! The security engineer needs to remember that network ACLs are stateless, so they need to add rules for both inbound and outbound traffic. C and D are the way to go.
upvoted 0 times
Kanisha
16 days ago
Good to know! Thanks for the explanation.
upvoted 0 times
...
Gracia
18 days ago
Yes, and adding an inbound allow rule for 192.168.1.0/24 in subnet-2-NACL will allow communication from public-subnet-1 to private-subnet-2.
upvoted 0 times
...
Emiko
19 days ago
Exactly! Those are the correct steps to take.
upvoted 0 times
...
Elly
22 days ago
Exactly! Adding an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL will allow communication from private-subnet-2 to public-subnet-1.
upvoted 0 times
...
Shawn
26 days ago
D) Add an inbound allow rule for 192.168.1.0/24 in subnet-2-NACL.
upvoted 0 times
...
Virgina
29 days ago
C) Add an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL.
upvoted 0 times
...
...
Bette
2 months ago
I'm not sure about that. Maybe we should also consider adding an outbound allow rule for 192.168.1.0/24 in the VPC's default network ACL.
upvoted 0 times
...
Willetta
2 months ago
I'm pretty sure the answer is C and E. Why would we need to touch the VPC's default network ACL? That seems like overkill.
upvoted 0 times
Rusty
21 days ago
So the correct combination would be C, E, and also D. Thanks for pointing that out.
upvoted 0 times
...
Jackie
26 days ago
You're correct, we should add an inbound rule in subnet-2-NACL as well.
upvoted 0 times
...
Aleisha
1 months ago
But wouldn't adding an inbound rule in subnet-2-NACL also be necessary?
upvoted 0 times
...
Naomi
1 months ago
I think you're right, C and E should do the trick.
upvoted 0 times
...
...
Justine
2 months ago
The correct answers are C and D. By adding an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL and an inbound allow rule for 192.168.1.0/24 in subnet-2-NACL, the security engineer can restore communication between the EC2 instances in the two subnets.
upvoted 0 times
...
Demetra
2 months ago
I agree with Elin. We also need to add an inbound allow rule for 192.168.1.0/24 in subnet-2-NACL.
upvoted 0 times
...
Elin
2 months ago
I think we should add an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL.
upvoted 0 times
...

Save Cancel