There are several EC2 instances in a VPC subnet. All instances use the same security group (sg-12345678). The security group has the following rules:
Inbound:
Type
Protocol
Port Range
Source
All traffic
All
All
sg-12345678
SSH
TCP
22
172.31.1.6/32
Outbound:
Type
Protocol
Port Range
Destination
All traffic
All
All
sg-12345678
The subnet is associated with a network ACL that has the inbound/outbound rules as follows:
Inbound:
Rule
Type
Protocol
Port Range
Source
Allow/Deny
100
SSH
TCP
22
172.31.1.6/32
Allow
*
All traffic
All
All
0.0.0.0/0
Deny
Outbound:
Rule
Type
Protocol
Port Range
Destination
Allow/Deny
100
Custom TCP
TCP
1024-65535
172.31.1.6/32
Allow
*
All traffic
All
All
0.0.0.0/0
Deny
With these configurations, which kinds of traffic are allowed for the instances in the subnet?

Answer options:

A.Only the remote host (172.31.1.6/32) can connect to the instances via RDP, and instances in the subnet cannot communicate with the outside or each other.
B.The remote host (172.31.1.6/32) has the SSH access to the instances and instances in the subnet can communicate with each other.
C.No remote host can SSH to the instances as the ACL outbound rule disallows it. Instances within the subnet can talk with each other.
D.Only the remote host (172.31.1.6/32) can connect to the instances via the SSH protocol, but instances in the subnet cannot communicate with each other.

Correct Answer – B
Security groups and ACLs are used together to control the traffic as layers of security to the VPC. In the ACL, only SSH access from the host 172.31.1.6/32 is allowed, and other hosts are not allowed. The security group allows SSH access from 172.31.1.6/32, and it also allows all traffic from the instances with the security group of sg-12345678.
Option A is incorrect: Because the inbound traffic must be the protocol of SSH instead of RDP. And instances can communicate with each other.
Option B is CORRECT: Refer to the above explanations.
Option C is incorrect: Because the outbound rule (100) in ACL allows the traffic to 172.31.1.6/32. The port range 1024-65535 is an ephemeral port range.
Option D is incorrect: The inbound rule in the security group allows all traffic from sg-12345678 so that instances are allowed to communicate with each other.