Quick Answer

The correct approach is to use a private subnet, a security group, and a network ACL to block outbound internet traffic except to a trusted vendor. This works because placing the web tier instances in a private subnet automatically denies them public IP addresses, while a security group provides stateful, instance-level control to allow outbound traffic only to the vendor’s IP range, effectively blocking all other internet destinations. However, since security groups are stateful, a network ACL on the private subnet must also explicitly allow outbound traffic to the trusted vendor’s IP range and to the NAT gateway, because the NACL is stateless and must permit the return traffic from the vendor. On the SAA-C03 exam, this scenario tests your understanding of combining subnet-level and instance-level filters, with a common trap being forgetting that a stateless NACL requires explicit rules for both outbound and inbound return traffic. A helpful memory tip: “Security groups remember, NACLs need permission for every direction.”