A company plans to run a computationally intensive data processing application on AWS. The data is highly sensitive. The VPC must have no direct internet access, and the company has applied strict network security to control access. Data scientists will transfer data from the company's on-premises data center to the instances by using an AWS Site-to-Site VPN connection. The on-premises data center uses the network range 172.31.0.0/20 and will use the network range 172.31.16.0/20 in the application VPC. The data scientists report that they can start new instances of the application but that they cannot transfer any data from the on-premises data center. A network engineer enables VPC flow logs and sends a ping to one of the instances to test reachability. The flow logs show the following: The network engineer must recommend a solution that will give the data scientists the ability to transfer data from the on-premises data center. Which solution will meet these requirements?
Select one answer.
Marked answer: C
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose C2
First the NACL is evaluated (stateless), and then if the traffic is allowed the SG will be evaluated (statefulll). The first packet arrives and is allowed, so NACL ok and SG OK, but the second packet returning is denied. This discard the problem in a SG, because the SG being stateful would allow the traffic. And so must be the NACL denying
Chose C2
C is correct. because NACL is stateless so thus need to add permit!
1
Ans is A - B:Modifying the outbound ACL wouldn't address the inability to initiate data transfer from the on-premises side.
