An instance is launched into a VPC subnet with the network ACL configured to allow all inbound traffic and
deny all outbound traffic. The instance’s security group is configured to allow SSH from any IP address and
deny all outbound traffic. What changes need to be made to allow SSH access to the instance?
A.
The outbound security group needs to be modified to allow outbound traffic.
B.
The outbound network ACL needs to be modified to allow outbound traffic.
C.
Nothing, it can be accessed from any IP address using SSH.
D.
Both the outbound security group and outbound network ACL need to be modified to allow outbound
traffic.
B
Why not C?
B >> As NACL is stateless in nature.
Network ACLs are stateless; responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa).
Source: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html
Thank you Harsh!
B
JM is right Network ACLs are stateless
C,D
sorry, Answer is B
I choose D
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html
B is correct
Outside ACL being stateless, it supersedes security groups as they are applied on the subnet level
B
B should be correct because, Security group is stateful while nACL is stateless. But if you want to be politically correct the D is the right.
I think answer is B
no need to enable outbound traffic for security group as it is state-full unlike ACL (state-less)
B is right:
at ACL: Need to open TCP Port 1024-65535 at Outbound Rules
“Allows outbound responses to the remote computer. Network ACLs are stateless, therefore this rule is required to allow response traffic for inbound requests.”
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html
coding.smashingmagazine.com/2013/01/30/introduction-to-firewalls/
gives a very cleary explaination for Firewall Statless and state. Inbound and Outbond.
Thus, the answer is B.
B is right. In security group, you can not add “DENY” rules.
Correct Answer is B as Security groups can specify only Allow rules, but not deny rules
and by default security groups allow all outbound traffic
B
I think Answer is C
Question is does SSH require outbound traffice to access from outside ?
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html
B
ACL’s are stateless
C is correct. I tested it. The instance’s security group is configured to only allow SSH from IP address and deny all outbound traffic. But SSH access to the instance. It isn’t nessesary outbound traffic.
C is the correct answer . ssh DOES NOT require Outbound Traffic permissions . As long as inbound traffic to port 22 is allowed , you should be fine.
I tested this and found option “D” is the correct answer.
Can you explain it a bit about the setup and security group that you were using.
As per the link http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html
You can specify allow rules, but not deny rules.
You can specify separate rules for inbound and outbound traffic.
When you create a security group, it has no inbound rules. Therefore, no inbound traffic is allowed until you add inbound rules to the security group.
By default, a security group includes an outbound rule that allows all outbound traffic. You can remove the rule and add outbound rules that allow specific outbound traffic only. If your security group has no outbound rules, no outbound traffic is allowed.
Security groups are stateful — if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. Responses to allowed inbound traffic are allowed to flow out, regardless of outbound rules.
C is the correct answer
The instance’s security group is configured to allow SSH from any IP address and deny all outbound traffic
C = Correct because it says ANY IP is allowable into but DENY going out
Too many different answers. Just gone ahead and replicated this requirement, then, run instance and was able to connect/login via SSH without any issues.
C appears to correct answer.
D is right. Even though security groups are stateful by default, in this case the outbound rule had been modified to deny all outbound traffic. So it needs changing to allowed. As NACL are stateless, it naturally needs outbound rules modified.
yeah , answer is C…
Nah, answer is D. You can remove outbound rule in security groups ,which effectively denies all outbound traffic. So both SG and NACL need to be modified to allow outbound traffic.
Modifying Security Group will not be required as they allow configuring only allow.
NACL’s support specifying Deny and NACL will be enforced before changing.
To Enable SSH , it is required to modify only NACL and best option will be B.
B is correct answer
Network ACLs are stateless hence if you have allow rule set for inbound traffic then you should also allow outbound traffic be also set.
Answer is C.
You can enable an Inbound rule in a Security Group, by example SSH access. The rules are stateful in Security Groups. Is not necessary allow output traffic because when you enable a Inbound rule, automatically is allowed output traffic for this port.
correct answer B.
The outbound & Inbound network ACL needs to be modified to allow traffic – MUST
B.
The outbound network ACL needs to be modified to allow outbound traffic.
C is the correct answer
B is the right answer(tested)
tested it, no need to change SG but ACL needs to be added, so B is right
A is wrong bcz in SG if inbound is allowed by default outbound is allowed.
B is more like yes, but in the question it states that instance’s security group is configured to allow SSH from any “IP address”- check with A.
c is right, bcz as it is allowed via ssh from any ip address we don’t have to make any changes.
D is wrong as we don’t have any specific option to modify the outbound rule in SG.
Sorry but after rephrasing the question, B is the right answer bcz even the security group is allowing SSH from any IP but NACL would block the outbound.
So we need to change the NACL
As Junaid mentioned above, “statefull” means that “responses” to allowed inbound traffic are always allowed back out again. Not any traffic using same ports.
Did a test, with a SG allowing port 22 & 80 in and without any outbound rule. Could easily login via ssh and/or access the index.html file of a httpd service, but wasnt capable using services of same traffic/port type from within the instance going out (ssh into another instance in same SG or yum updates), without adding the corresponding outbound port rules to the SG.
B is the only correct answer.
B
“An instance is launched into a VPC subnet with the network ACL configured to allow all inbound traffic and deny all outbound traffic”
=> NACL is stateless so you need to modify it.
“The instance’s security group is configured to allow SSH from any IP address and deny all outbound traffic”
=> Security Group is stateful so you don’t need to modify anything.