Exam AWS Certified SysOps Administrator - Associate topic 1 question 256 discussion

D is correct

flow log->vpc->nnetwork acl

I go with Vivec !!!

Correct answer here is D. But you need to take to consideration that question can be changed on the exam, because from Aug 10, 2023 NLB started supporting Security groups. https://aws.amazon.com/about-aws/whats-new/2023/08/network-load-balancer-supports-security-groups/

The example from the link exactly matches "D" (other than the question example is using HTTP/8080 web proxy port instead of link ICMP example which doesn't show ports). Security group and network ACL rules [...] - "An ACCEPT record for the originating ping that was allowed by both the network ACL and the security group, and therefore was allowed to reach your instance." - "A REJECT record for the response ping that the network ACL denied." [...] 203.0.113.12 172.31.16.139 0 0 1 4 336 1432917027 1432917142 ACCEPT OK [...] 172.31.16.139 203.0.113.12 0 0 1 4 336 1432917094 1432917142 REJECT OK https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-security-groups

The network ACL that is associated with the subnet does not allow outbound traffic for the ephemeral port range. https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html

The traffic isn't going out, so the SG is correct but not the outbound ACL rule.

I go for D. If your network ACL permits outbound ICMP traffic, the flow log displays two ACCEPT records (one for the originating ping and one for the response ping). If your security group denies inbound ICMP traffic, the flow log displays a single REJECT record, because the traffic was not permitted to reach your instance. https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#:~:text=1431280876%201431280934%20%2D%20SKIPDATA-,Security%20group%20and%20network%20ACL%20rules,-If%20you%27re%20using

According to the flow log record shown in the picture, the traffic is rejected by the security group of the NLB, which means that the traffic is not reaching the EC2 instances. The source IP address in the flow log is from an on-premises environment, which indicates that the issue is related to the communication between the on-premises environment and the NLB. Since the NLB is the entry point for the traffic to reach the EC2 instances, it is important to ensure that the security group of the NLB allows traffic from the on-premises environment. The security group rules should allow inbound traffic from the IP addresses or the CIDR blocks of the on-premises environment on the relevant port (8080 in this case).

I’ll go for D. Looks like that NACL allows inbound traffic from ephemeral port range, but doesn’t allow outbound.