Independence Day Deal! Unlock 25% OFF Today – Limited-Time Offer - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Amazon Exam SCS-C02 Topic 6 Question 31 Discussion

Actual exam question for Amazon's SCS-C02 exam
Question #: 31
Topic #: 6
[All SCS-C02 Questions]

An AWS account that is used for development projects has a VPC that contains two subnets. The first subnet is named public-subnet-1 and has the CIDR block 192.168.1.0/24 assigned. The other subnet is named private-subnet-2 and has the CIDR block 192.168.2.0/24 assigned. Each subnet contains Amazon EC2 instances.

Each subnet is currently using the VPC's default network ACL. The security groups that the EC2 instances in these subnets use have rules that allow traffic between each instance where required. Currently, all network traffic flow is working as expected between the EC2 instances that are using these subnets.

A security engineer creates a new network ACL that is named subnet-2-NACL with default entries. The security engineer immediately configures private-subnet-2 to use the new network ACL and makes no other changes to the infrastructure. The security engineer starts to receive reports that the EC2 instances in public-subnet-1 and public-subnet-2 cannot communicate with each other.

Which combination of steps should the security engineer take to allow the EC2 instances that are running in these two subnets to communicate again? (Select TWO.)

Show Suggested Answer Hide Answer
Suggested Answer: C

Contribute your Thoughts:

Aleshia
2 months ago
I bet the security engineer is scratching their head over this one. Maybe they should consult the AWS documentation - it's the holy grail for these kinds of questions!
upvoted 0 times
Winfred
11 days ago
Consulting the AWS documentation is always a good idea!
upvoted 0 times
...
Barney
22 days ago
B) Add an inbound allow rule for 192.168.1.0/24 in subnet-2-NACL.
upvoted 0 times
...
Stephaine
23 days ago
A) Add an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL.
upvoted 0 times
...
Jeanice
1 months ago
The security engineer should definitely check the AWS documentation for guidance.
upvoted 0 times
...
Frank
1 months ago
C) Add an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL.
upvoted 0 times
...
Shawnna
1 months ago
A) Add an outbound allow rule for 192.168.2.0/24 in the VPC's default network ACL.
upvoted 0 times
...
...
Deeanna
2 months ago
This is a tricky one, but I think the security engineer should go with C and D. Gotta love those network ACL shenanigans!
upvoted 0 times
...
Rashad
2 months ago
Haha, this question is a classic! The security engineer needs to remember that network ACLs are stateless, so they need to add rules for both inbound and outbound traffic. C and D are the way to go.
upvoted 0 times
Kanisha
1 months ago
Good to know! Thanks for the explanation.
upvoted 0 times
...
Gracia
1 months ago
Yes, and adding an inbound allow rule for 192.168.1.0/24 in subnet-2-NACL will allow communication from public-subnet-1 to private-subnet-2.
upvoted 0 times
...
Emiko
1 months ago
Exactly! Those are the correct steps to take.
upvoted 0 times
...
Elly
1 months ago
Exactly! Adding an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL will allow communication from private-subnet-2 to public-subnet-1.
upvoted 0 times
...
Shawn
1 months ago
D) Add an inbound allow rule for 192.168.1.0/24 in subnet-2-NACL.
upvoted 0 times
...
Virgina
1 months ago
C) Add an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL.
upvoted 0 times
...
...
Bette
2 months ago
I'm not sure about that. Maybe we should also consider adding an outbound allow rule for 192.168.1.0/24 in the VPC's default network ACL.
upvoted 0 times
...
Willetta
2 months ago
I'm pretty sure the answer is C and E. Why would we need to touch the VPC's default network ACL? That seems like overkill.
upvoted 0 times
Rusty
1 months ago
So the correct combination would be C, E, and also D. Thanks for pointing that out.
upvoted 0 times
...
Jackie
1 months ago
You're correct, we should add an inbound rule in subnet-2-NACL as well.
upvoted 0 times
...
Aleisha
2 months ago
But wouldn't adding an inbound rule in subnet-2-NACL also be necessary?
upvoted 0 times
...
Naomi
2 months ago
I think you're right, C and E should do the trick.
upvoted 0 times
...
...
Justine
2 months ago
The correct answers are C and D. By adding an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL and an inbound allow rule for 192.168.1.0/24 in subnet-2-NACL, the security engineer can restore communication between the EC2 instances in the two subnets.
upvoted 0 times
...
Demetra
2 months ago
I agree with Elin. We also need to add an inbound allow rule for 192.168.1.0/24 in subnet-2-NACL.
upvoted 0 times
...
Elin
3 months ago
I think we should add an outbound allow rule for 192.168.2.0/24 in subnet-2-NACL.
upvoted 0 times
...

Save Cancel
az-700  pass4success  az-104  200-301  200-201  cissp  350-401  350-201  350-501  350-601  350-801  350-901  az-720  az-305  pl-300  

Warning: Cannot modify header information - headers already sent by (output started at /pass.php:70) in /pass.php on line 77