Troubleshoot Inbound Traffic Blocked by NACL
Exhibit
Refer to the exhibit. [VPC Flow Logs output] 2 123456789010 eni-12345678 10.0.1.5 10.0.2.10 443 443 6 10 1000 1620000000 1620000010 ACCEPT OK 2 123456789010 eni-12345678 10.0.1.5 10.0.2.10 22 22 6 5 500 1620000010 1620000020 ACCEPT OK 2 123456789010 eni-12345678 10.0.1.5 203.0.113.5 443 443 6 20 2000 1620000020 1620000030 ACCEPT OK 2 123456789010 eni-12345678 203.0.113.5 10.0.1.5 443 443 6 15 1500 1620000030 1620000040 REJECT OK
A security engineer reviews VPC Flow Logs and sees the entries shown. The last entry shows a REJECT for traffic from 203.0.113.5 to 10.0.1.5 on port 443. However, the third entry shows ACCEPT for traffic from 10.0.1.5 to 203.0.113.5 on port 443. What is the most likely reason for the REJECT?
Quick Answer
The answer is a network ACL blocking inbound return traffic, because the VPC Flow Logs show an ACCEPT for outbound traffic from 10.0.1.5 to 203.0.113.5 on port 443, followed by a REJECT for the corresponding inbound response from 203.0.113.5 to 10.0.1.5 on the same port. This pattern is the hallmark of a stateless firewall—unlike a security group, which automatically allows return traffic, a network ACL requires explicit inbound rules for every flow, even if it is a response to an allowed outbound connection. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this question tests your ability to distinguish between stateful and stateless filtering by reading flow log entries; a common trap is assuming security groups are involved when the reject appears, but remember that security groups are stateful and would never drop a reply to an allowed outbound request. To troubleshoot inbound traffic blocked by NACL, always check that your inbound NACL rules mirror the ephemeral ports and protocols used by outbound traffic. Memory tip: NACL is “Not ACL” but “No Automatic Comeback Logic”—it forgets the conversation, so you must write both directions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network ACL associated with the subnet of 10.0.1.5 does not allow inbound traffic from 203.0.113.5.
The VPC Flow Logs show outbound traffic from 10.0.1.5 to 203.0.113.5 on port 443 was allowed (ACCEPT), but the inbound response was rejected. Security groups are stateful, so they automatically allow return traffic for established connections. Therefore, a security group (Option C) would not cause this REJECT. Network ACLs are stateless and require explicit inbound rules; if the inbound rule for traffic from 203.0.113.5 is missing, the response is dropped, resulting in a REJECT. Option A correctly identifies this. Option B (AWS WAF) operates at the application layer (Layer 7) and is not reflected in VPC Flow Logs, which capture Layer 3/4 traffic. Option D (route table) would cause a lack of connectivity, not a REJECT entry in flow logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The network ACL associated with the subnet of 10.0.1.5 does not allow inbound traffic from 203.0.113.5.
Why this is correct
NACLs are stateless and require explicit inbound rules for response traffic.
- ✗
AWS WAF is blocking the inbound traffic.
Why it's wrong here
WAF works at layer 7 and would not appear in VPC Flow Logs at layer 4.
- ✗
The security group attached to the instance 10.0.1.5 does not allow inbound traffic from 203.0.113.5.
Why it's wrong here
Security groups are stateful, so return traffic is automatically allowed.
- ✗
The route table for the subnet of 10.0.1.5 does not have a route to the internet.
Why it's wrong here
Route tables do not cause REJECT; they cause no route.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A network engineer is troubleshooting connectivity issues from an EC2 instance in subnet-11111111. The instance can send traffic outbound, but cannot receive inbound HTTPS traffic from the internet. What is the likely cause?
hard- ✓ A.The inbound rule only allows HTTPS, but the outbound rule allows all traffic; this is correct
- B.The NACL is not associated with the correct subnet
- C.The inbound rule should also allow ICMP traffic
- D.The outbound rule should restrict traffic to only ephemeral ports
Why A: The NACL inbound rule allows HTTPS (port 443) from 0.0.0.0/0, and the outbound rule allows all traffic. NACLs are stateless, so the outbound all-traffic rule correctly permits response traffic using ephemeral ports (1024–65535). Therefore, the NACL configuration is correct for inbound HTTPS traffic. The issue must lie elsewhere, such as the instance's security group not allowing inbound HTTPS, or a missing internet gateway route. Option C is correct because it acknowledges that the NACL is not misconfigured, which is the likely scenario given the exhibit.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.