Your company has set EC2 Instances in a VPC. These Instances have been configured to query an on-premises Data center DNS server. But the Instances are not able to reach the on-premises server. Which of the following could be a reason for this? Choose the best answer from the options given below.

Answer options:

A.The Security Groups for the EC2 Instances are blocking incoming on port 53.
B.The NACLs are blocking outgoing on port 53 for TCP.
C.The NACLs are blocking outgoing on port 53 for UDP.
D.The NACLs are blocking incoming on port 53 for TCP.
E.The NACLs are blocking incoming on port 53 for UDP.

Answer – C
In order to communicate with a DNS Server, the instance needs to reach the DNS server on port 53 for UDP.
Options A, D and E are invalid since this issue is with the outgoing traffic.
Option B is INCORRECT because TCP 53 is used for DNS zone transfers and should be allowed between trusted DNS servers.
For more information on NACLs, please refer to the below URL
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html