ANS-C01 NACL Rule Evaluation Order Practice Question
Network Topology
A network engineer is troubleshooting SSH connectivity to an EC2 instance in subnet subnet-0abcd1234efgh5678, which is associated with the network ACL shown. The security group allows inbound SSH. Why can't the engineer SSH to the instance?
⚠ Common exam trap
Candidates often assume that an allow rule with a lower number always overrides a deny rule with a higher number. However, the allow rule must match the specific traffic; if it does not, the deny rule will apply.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network ACL rule 200 denies SSH traffic, overriding rule 100
The network ACL exhibit shows inbound rule 100 allowing HTTP traffic (port 80) and rule 200 denying SSH traffic (port 22). Since NACL rules are evaluated in ascending order, when an SSH packet arrives, rule 100 does not match (it allows HTTP, not SSH), so rule 200 matches and denies the traffic. Thus, SSH is blocked. Option A is wrong because the security group allows SSH. Option B is wrong because the subnet is associated with the NACL as stated. Option C is wrong because rule 300 is a higher-numbered rule and would only be evaluated if no earlier rule matched; here rule 200 already matches and denies SSH.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The security group is blocking SSH traffic
Why it's wrong here
Incorrect. The security group allows inbound SSH, so it is not blocking the traffic.
- ✗
The network ACL is not associated with the subnet
Why it's wrong here
Incorrect. The subnet is associated with the network ACL shown; if no custom NACL were associated, the default NACL (allow all) would apply, but the custom NACL is associated as per the question.
- ✗
The network ACL has a rule that denies all traffic (rule 300) which overrides the allow rule
Why it's wrong here
Incorrect. While rule 300 denies all traffic, it is evaluated after rule 100 and rule 200. Since rule 100 does not match SSH and rule 200 matches and denies, rule 300 is not reached for SSH traffic.
- ✓
The network ACL rule 200 denies SSH traffic, overriding rule 100
Why this is correct
Correct. The network ACL has rule 200 that explicitly denies SSH traffic. Because rule 100 only allows HTTP, not SSH, rule 200 is the first matching rule for SSH and denies it.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.