You have a web server hosted on an EC2 Instance. The subnet hosting the EC2 Instance has the following NACL attached
INBOUND RULES:
Rule # Type Protocol Port Range Source Allow / Deny
100 HTTP(80) TCP(6) 80 0.0.0.0/0 ALLOW
101 HTTPS(443) TCP(6) 443 0.0.0.0/0 ALLOW
OUTBOUND RULES:
Rule # TYPE Protocol Port Range Destination Allow / Deny
200 HTTP(80) TCP(6) 80 0.0.0.0/0 ALLOW
201 HTTPS(443) TCP(6) 443 0.0.0.0/0 DENY
1000 ALL Traffic ALL ALL 0.0.0.0/0 ALLOW
* ALL Traffic ALL ALL 0.0.0.0/0 DENY
What happens when a request comes from the internet to the webserver on port 80?

Answer options:

A.The request will be allowed because of Rule no 100 which matches the request
B.The request will be allowed because of Rule no 1000 which matches the request
C.The request will be denied because of Rule no 200
D.The request will be denied because of Rule no *

Answer – A
Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches traffic, it`s applied regardless of any higher-numbered rule that may contradict it.
Hence when the request comes from the internet , Rule no 100 will match for the port 80 request.
As a packet comes to the subnet, we evaluate it against the ingress rules of the ACL the subnet is associated with (starting at the top of the list of rules, and moving to the bottom). Here`s how the evaluation goes if the packet is destined for the SSL port (443). The packet doesn`t match the first rule evaluated (rule 100). It does match the second rule (110), which allows the packet into the subnet. If the packet had been destined for port 139 (NetBIOS), it doesn`t match any of the rules, and the * rule ultimately denies the packet.
You might want to add a DENY rule in a situation where you legitimately need to open a wide range of ports, but there are certain ports within that range you want to deny. Just make sure to place the DENY rule earlier in the table than the rule that allows the wide range of port traffic.
For more information on NACL’s please see the below link:
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html