ANS-C01 Network Security, Compliance and Governance Practice Question

Correct answer & explanation

The inbound rule (egress=false) only allows TCP (protocol 6) on port unspecified (all ports), but the outbound rule allows all traffic. However, the inbound rule only allows TCP, so return traffic for non-TCP protocols (like ICMP) is blocked. But the question says connectivity fails, likely because the instance initiates outbound traffic (e.g., HTTP), which is TCP, so that should work. Actually, the issue is that the outbound rule allows all traffic, but the inbound rule only allows TCP, so return traffic for non-TCP (like UDP or ICMP) is blocked. But typical HTTP uses TCP, so maybe the issue is something else. Let's re-evaluate: The outbound rule allows all traffic (protocol -1), but the inbound rule only allows TCP. For outbound connections, the return traffic is inbound, so if the outbound connection is TCP, the return TCP packets are allowed by the inbound rule. However, if the outbound traffic is something else like ICMP (ping), the return ICMP is blocked. The question does not specify the protocol. Option A is correct because the inbound rule only allows TCP, blocking other protocols. Option B is wrong because the outbound rule allows all traffic. Option C is wrong because the security group allows outbound. Option D is wrong because the inbound rule does not restrict TCP on ephemeral ports; it allows TCP from 0.0.0.0/0.