An IT team has deployed a new Amazon EC2 instance within Amazon VPC. They are trying to ping this Instance from a public network and are getting failed. The IT Team has already enabled internet access on this instance. All existing Amazon EC2 instances are pinging. For further troubleshooting, the IT Team have captured VPC flow logs as follows,
“2 123456123456 eni-1111b8ca111111111 132.0.11.25 172.31.26.189 0 0 1 4 336 1432917027 1432917142 ACCEPT OK” 
“2 123456123456 eni-1111b8ca111111111 172.31.26.189 132.0.11.250 0 1 4 336 1432917027 1432917142 REJECT OK” 
Which network element needs to be checked for rectification?

Answer options:

A.Security Group
B.NACL
C.VPC Route table
D.Elastic IP address

Correct Answer: B
NACL is stateless. Specific entries need to be added for both inbound and outbound traffic. In the above case, since incoming traffic is seen as accepted in VPC flow logs, inbound rules are properly added in NACL. Since outgoing traffic is getting rejected, NACL outbound rules need to be checked.
Option A is incorrect. As logs show inbound requests from public IP addresses are allowed, a proper inbound security group is attached to the instance. Since the Security group is stateful, it will be allowed outbound traffic for all inbound traffic. 
Option C is incorrect. Since all other Amazon EC2 instances can`t ping, there is no issue with the VPC route table.
Option D is incorrect. From the VPC flow logs, it is seen that Instance is assigned a private IP address, is not a public Elastic IP address.
For more information on VPC Flow Logs, refer to the following URL,
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html