A company runs a web application on an Amazon EC2 instance within a VPC. The instance is l… — AWS Certified SysOps Administrator - Associate

A company runs a web application on an Amazon EC2 instance within a VPC. The instance is launched in a public subnet with a CIDR block of $172.31.10.0/24$ and has an associated Elastic IP address. The application must accept incoming HTTPS requests from clients on the internet on port 443, and the instance must also initiate outbound HTTPS connections on port 443 to download software updates from an external repository.

Currently, the EC2 instance cannot be reached from the internet, and it cannot access the external update repository. A SysOps administrator confirms the following configurations:
- The EC2 instance's Security Group allows inbound and outbound TCP traffic on port 443.
- The subnet is associated with a custom Network ACL (NACL) that allows inbound and outbound TCP traffic on port 443, but blocks all other traffic.
- The subnet's route table has a route for the local VPC CIDR block, but no route for the destination $0.0.0.0/0$ .

Which of the following actions should the SysOps administrator take to resolve these connectivity issues? (Select TWO.)

Add a route to the subnet's route table with a destination of $0.0.0.0/0$ and the Internet Gateway as the target.Answer
Update the custom Network ACL rules to allow inbound and outbound traffic on the ephemeral port range of $1024-65535$ .Answer
C
Add a route to the subnet's route table with a destination of $0.0.0.0/0$ and a newly created NAT Gateway as the target.
D
Add rules to the EC2 instance's security group to allow inbound traffic on ephemeral ports $1024-65535$ .
E
Associate a Gateway VPC Endpoint with the subnet's route table for the destination of the external software repository.

Answer

To restore internet connectivity and resolve the routing issues, the SysOps administrator must add a default route (

0.0.0.0/0

) targeting the Internet Gateway in the subnet's route table, and update the custom Network ACL rules to allow traffic on the ephemeral port range (

1024-65535

) in both directions.

The correct options are the actions to add a route to the subnet's route table with a destination of

0.0.0.0/0

targeting the Internet Gateway, and to update the custom Network ACL rules to allow traffic on the ephemeral port range of

1024-65535

. These address the missing route to the internet and ensure that return traffic is not blocked by the stateless Network ACL.

Step-by-Step Solution

Verify and update the subnet's route table configuration.

Adding a route with destination

0.0.0.0/0

targeting the Internet Gateway allows the instance's outbound traffic to reach the internet and inbound traffic to be routed to the subnet.

Without a default route to an Internet Gateway, the subnet behaves as a private subnet, preventing any direct internet communication despite having an Elastic IP address.

Analyze the Network ACL (NACL) rules for stateless traffic flow.

Allowing inbound and outbound traffic on ephemeral ports (

1024-65535

) enables return traffic for both client-initiated and instance-initiated connections.

Because NACLs are stateless, they do not automatically allow return traffic. Since the current custom NACL only allows port 443 in both directions, return traffic directed at ephemeral ports is blocked.

Key Concept

VPC public routing requires an Internet Gateway route in the route table, and stateless Network ACLs require explicit rules for both request ports and response (ephemeral) ports.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic