Exam AWS Certified SysOps Administrator - Associate topic 1 question 415 discussion

Exam question from Amazon's AWS Certified SysOps Administrator - Associate

Question #: 415
Topic #: 1

[All AWS Certified SysOps Administrator - Associate Questions]

A company hosts a web application on an Amazon EC2 instance in a production VPC. Client connections to the application are failing. A SysOps administrator inspects the VPC flow logs and finds the following entry:

What is a possible cause of these failed connections?

A. A security group deny rule is blocking traffic on port 443.
B. The EC2 instance is shut down.
C. The network ACL is blocking HTTPS traffic.
D. The VPC has no internet gateway attached.

Show Suggested Answer

Suggested Answer: C 🗳️

by LemonGremlin at Dec. 30, 2023, 1:48 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

LemonGremlin

Highly Voted 1 year, 6 months ago

Selected Answer: C

Answer is C. please see the section "Accepted and rejected traffic" example in below page https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-accepted-rejected

upvoted 7 times

...

SysOps4

Most Recent 1 year ago

Selected Answer: C

C A is not an option - "Security group rules are always permissive; you can't create rules that deny access." https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html

upvoted 1 times

...

Student013657

1 year ago

Selected Answer: C

The VPC flow log entry provided in the question shows a REJECT action, which indicates that the traffic is being blocked by a network ACL (NACL) rule. The flow log entry shows the following details: - Source IP: 192.0.2.15 (which is likely the client's IP address) - Destination IP: 203.0.113.56 (which is likely the EC2 instance's IP address) - Destination port: 443 (which is the standard HTTPS port) - Protocol: 6 (which is TCP)

upvoted 2 times

...

6022a06

1 year, 1 month ago

In accordingly to the document https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-accepted-rejected is reported that: "If your network ACL permits outbound ICMP traffic, the flow log displays two ACCEPT records (one for the originating ping and one for the response ping). If your security group denies inbound ICMP traffic, the flow log displays a single REJECT record, because the traffic was not permitted to reach your instance." So in our case we have a sigle REJECT record then the problem is related to security group the not permit the traffic on 443 port. For me Answer is A

upvoted 2 times

...