ANS-C01 Network Management and Operations Practice Question

Network Topology

A network engineer configured a custom network ACL for a VPC. An EC2 instance in a subnet associated with this ACL cannot receive ping (ICMP) from the internet. The security group allows ICMP. Which rule is causing the issue?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Inbound rule 130 allows ICMP, but it is overridden by rule 120.

NACL rules are evaluated in ascending order by rule number. Rule 120 (deny all) has a lower number than rule 130 (allow ICMP), so it is evaluated first. Thus, ICMP traffic from the internet is denied by rule 120 before rule 130 can allow it. Option A is incorrect because the default NACL rules are not missing; the issue is the order. Option B is incorrect because outbound rules are not the problem for inbound ICMP. Option D is incorrect because inbound rule 100 allows HTTPS but does not affect ICMP.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The default NACL rules are missing.
Why it's wrong here
The custom NACL is not default; the issue is the order of rules.
✗
Outbound rule 220 blocks all outbound traffic.
Why it's wrong here
Outbound traffic for established sessions (ephemeral ports) is not blocked; the issue is inbound.
✓
Inbound rule 130 allows ICMP, but it is overridden by rule 120.
Why this is correct
Rule 120 (deny all) is evaluated before rule 130 (allow ICMP), so ICMP is denied.
✗
Inbound rule 100 only allows HTTPS.
Why it's wrong here
Rule 100 allows HTTPS, which is not ICMP.

Visual reference

Go deeper

ANS-C01 Network Management and Operations Practice Question

Why each option matters

Option-by-option breakdown

Related to this question