AWS Certified Security – Specialty — Question 220

A public subnet contains two Amazon EC2 instances. The subnet has a custom network ACL. A security engineer is designing a solution to improve the subnet security.
The solution must allow outbound traffic to an internet service that uses TLS through port 443. The solution also must deny inbound traffic that is destined for
MySQL port 3306.
Which network ACL rule set meets these requirements?

Answer options

• A. Use inbound rule 100 to allow traffic on TCP port 443. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
• B. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port range 1024-65535. Use outbound rule 100 to allow traffic on TCP port 443.
• C. Use inbound rule 100 to allow traffic on TCP port range 1024-65535. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
• D. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port 443. Use outbound rule 100 to allow traffic on TCP port 443.

Correct answer: B

Explanation

The correct answer is B because it blocks inbound MySQL traffic on port 3306 while allowing all other inbound traffic on ports 1024-65535, thus granting necessary flexibility. This option also permits outbound traffic on port 443, meeting the requirement for TLS traffic. The other options either do not adequately deny inbound MySQL traffic or incorrectly handle outbound rules.