Q75 — AWS SAA-C03 Ch.15

Question 75 of 100 | ← Chapter 15

Q1175. A company runs multiple applications on Amazon EC2 instances in a VPC. Application A runs in a private subnet that has a custom route table and network ACL. Application B runs in a second private subnet in the same VPC.The company needs to prevent Application A from sending traffic to Application B.Which solution will meet this requirement?

Correct Answer: D. Add a deny outbound rule to the custom network ACL for the Application A subnet. Configure the rule to prevent Application A from sending traffic to lP addresses that are associated with the Application B subnet.

Explanation

To prevent Application A from sending traffic to Application B, you need to control the outbound traffic from Application A to the subnet where Application B resides. Here's an analysis of each option:Key Concepts:Security Groups:Security groups are stateful, meaning any outbound traffic allowed by a security group will automatically allow the corresponding inbound response traffic.Security groups operate at the instance level and can only contain allow rules (deny rules are not supported).Network ACLs (NACLs):Network ACLs are stateless, meaning you must explicitly allow both inbound and outbound traffic. Network ACLs operate at the subnet level and can contain both allow and deny rules.Analysis of Options:Option A: Add a deny outbound rule to a security group associated with Application B to prevent Application B from sending traffic to Application A.This does not solve the problem because the requirement is to prevent Application A from sending traffic to Application B, not the other way around.Additionally, security groups do not support deny rules, so this is not a valid approach. Option B: Add a deny outbound rule to a security group associated with Application A to prevent Application A from sending traffic to Application B.Security groups do not support deny rules, so this is not a valid approach. Option C: Add a deny outbound rule to the custom network ACL for the Application B subnet to prevent Application B from sending traffic to IP addresses associated with the Application A subnet. This does not solve the problem because the requirement is to prevent Application A from sending traffic to Application B, not the other way around.Also, modifying the NACL for Application B's subnet would not block traffic originating from Application A. Option D: Add a deny outbound rule to the custom network ACL for the Application A subnet to prevent Application A from sending traffic to IP addresses associated with the Application B subnet.This is the correct approach.By adding a deny outbound rule to the NACL for Application A's subnet, you can explicitly block traffic from Application A to the IP addresses of Application B's subnet. Since NACLs are stateless, you would also need to ensure that the corresponding inbound traffic is not allowed (though in this case, the deny outbound rule is sufficient to block the traffic from Application A to Application B).Final Answer:D. Add a deny outbound rule to the custom network ACL for the Application A subnet. Configure the rule to prevent Application A from sending traffic to IP addresses that are associated with the Application B subnet.This solution meets the requirement by explicitly blocking outbound traffic from Application A to the subnet where Application B resides, using the stateless nature of network ACLs to enforce the restriction.