SCS-C03 Infrastructure Security Practice Question
Exhibit
{
"NACL_Inbound": [
{"Rule": 100, "Protocol": "TCP", "Port": 80, "Source": "203.0.113.5/32", "Action": "DENY"},
{"Rule": 200, "Protocol": "TCP", "Port": 80, "Source": "0.0.0.0/0", "Action": "ALLOW"}
],
"SecurityGroup_Inbound": [
{"Protocol": "TCP", "Port": 80, "Source": "0.0.0.0/0", "Action": "ALLOW"}
]
}Refer to the exhibit. A user is attempting to connect to a web server from the IP address 203.0.113.5 on port 80. Based on the provided Network ACL and Security Group configurations, what will be the result of this connection attempt?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The connection will be denied because the NACL Rule 100 is evaluated first.
Network ACLs (NACLs) are processed before Security Groups for inbound traffic entering a subnet. NACLs are stateless and process rules in numerical order. In this scenario, Rule 100 in the NACL explicitly denies traffic from the specific IP address, so the packet is dropped before it can be evaluated by the Security Group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The connection will be allowed because the Security Group permits all traffic on port 80.
Why it's wrong here
Security Groups are stateful and allow traffic if a matching rule exists, but they are only evaluated after the stateless Network ACL. Since the NACL has already denied the traffic at the subnet boundary, the Security Group rules are never reached, and the connection attempt is effectively blocked.
- ✓
The connection will be denied because the NACL Rule 100 is evaluated first.
Why this is correct
NACLs process rules in order starting from the lowest number. Because Rule 100 matches the source IP and port with a 'DENY' action, the packet is immediately discarded. The higher-numbered 'ALLOW' rule and the permissive Security Group rules are ignored because the first matching NACL rule takes precedence.
- ✗
The connection will be allowed because NACL Rule 200 permits all traffic on port 80.
Why it's wrong here
While Rule 200 is an 'ALLOW' rule for all traffic, NACL rules are not cumulative; the first rule that matches the traffic criteria is applied. Since Rule 100 is a more specific match for the source IP and appears earlier in the sequence, Rule 200 is never applied to this specific connection.
- ✗
The connection will be denied because Security Groups take precedence over NACLs.
Why it's wrong here
This statement is technically incorrect regarding the flow of inbound traffic. In AWS networking, the Network ACL acts as a firewall for the entire subnet and is the first line of defense. Inbound traffic must pass the NACL evaluation before it can reach the Security Group protecting the individual instance.
Visual reference
About these practice questions
This SCS-C03 question is part of Courseiva's 99-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.