Exam ANS-C00 topic 1 question 235 discussion

D By default, new security groups start with only an outbound rule that allows all traffic to leave the resource. You must add rules to enable any inbound traffic or to restrict the outbound traffic. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

B The answer's explanation is very clear.

Key statement in the question : "The security group for your application server instances permits all traffic to the NAT gateway" (obviously horrible nature of the wording of the people who prepares these questions is still there but... :) ) Statement up above means that the outbound rule in the security group, to which the app server instances are associated with, only allows traffic to the NAT Gateway itself. This is not a route entry guys. This means, Source IPENI : Appserver , Destination IP/ENI : NAT Gateway, is allowed in the current security group. Hence you definitely need to add another rule to the security group of app server instances and that rule should allow traffic to the Destination : Git Repo.

For this Question I chose the elimination method. I eliminate A, C, D due to various reasons mentioned in the thread. Left over is Choice B. :-) In a real life I will have more cleared problem statement. For exam its ok.

B is correct. A & D are clearly wrong. C is wrong because they said NAT Gateway can reach the Git repo therefore NACL in the public subnet is OK.

B and D are OK. Why? From server to Git repository is HTTPS or SSH, always requires TCP handshakes on both way and security group is stateful. Once you add rule in either inbound or outbound, the remain way is auto-allowed. So why only D is correct? :)

Ans: B The phrase "The security group for your application server instances permits all traffic to the NAT gateway." means nothing Your application instance does not connect to the NAT gateway, so adding an ALLOW FROM <instance> TO <nat gateway> is useless What must be done: adding a ALLOW FROM <instance> TO <git repo> (using the proper IP information and possibly TCP if you want) Our instance does not connect to the nat gateway, the flow passes through

B - The traffic leaves the instance destined for the Git repository; at this point, the security group must allow it through. The route then directs that traffic (based on the IP) to the NAT gateway. A is wrong because it removes the private aspect of the subnet and would have no effect on the blocked traffic anyway. C is wrong because the problem is that outgoing traffic is not getting to the NAT gateway. D is wrong because to allow outgoing traffic to the Git repository requires an outgoing security group rule.

It says the SG already "permits all traffic to NAT gateway" and I guess it is different than permitting traffic to GIT through the NAT gateway. I think B makes sense. C is completely wrong though.

None of the answers is correct. There must be something messed up with NACL, so C is the closest answer.

the question already mentioned that "The security group for your application server instances permits all traffic to the NAT gateway."?

C looks more like the answer