Exam AWS Certified Security - Specialty topic 1 question 159 discussion

Short answer: A, C, D This question is poorly written. A: subnets don't have security groups, they have NACLs. Security groups are for resources. The route table is really important for this solution though. E: NAT Gateways don't have security groups To look at the answers: A: route table is important, so this must be included B: This is a subnet of answer C, and everything in C is needed, so B is incorrect as it's not a full answer. C: NACL rules on all subnets are relevant. Blocking inbound or outbound on the wrong ports will prevent communications. You also need to check the inbound NACL rules on the private subnet, probably ephemeral ports. D: yes, less likely but important E: NAT gateway doesn't have an SG so not that, and ALB is for ingress not egress via NAT gateway, so no. F: no, route needs to point to NAT gateway not internet gateway

ACD are the correct answer

i selected ABD

ABD ABD Since the instances are in the private subnet, they are not affected by the inbound or outbound rules on the public subnet. Therefore, checking the outbound network ACL rules on the private subnet and the inbound network ACL rules on the public subnet (option B) would be more appropriate in this scenario.

B does not seem to be right because we do not need inbound rules check- for public subnet

Answer CDE. I read the option E slightly in a different way. We need to verify the security group of ALB and also the NAT gateway set up. We should not read it as security group of NAT Gateway which would mislead us since NAT Gateway does not have security group

Except A and D I am not satisfied with any answers. NACL in all subnets should be checked for both directions.

A: routing tables is maybe the first thing I would check. C: I think we should also check the outbound, because its not stateful and we need to determine the ephemeral ports. D: If we configured any firewall on the host, this could obviously also a blocker. E: Security Group for ALB etc doesnt exist.... F: 0.0.0.0 .... just no.

Answer : A,C,D

I don't know why many people still select B & C. With AWS NACL you must check both inbound and outbound for each subnet, because they are stateless. Not check only one direction.

A - wrong -> private subnet security group rules and security group route tables E - wrong -> NAT gateway Security Group F - wrong -> private subnet route to the Internet gateway

Terrible question. Only wrong answer is A. All others could be the issue.

This question/answers is terrible. Might be the worst I've ever seen........

ACD for sure.

Nat Gateway do have secueity groups. Ultimately, Nat Gateway have enis and you can update the security group for the eni though I don't understand why someone would modify the SG in the first place.

C, D, E are correct. A. There is no such component as a "subnet security group". (Cannot be confirmed.) B. You need to check the outbound network ACL rules for the public subnet. F. You need to make sure that the 0.0.0.0/0 route in the private subnet route table points to the NAT gateway.

This question is terribly written. As others have said, you also need to check the inbound NACL on the private subnet (C) and security groups don't have route tables, even though that's supposedly the correct answer (A)