SCS-C02 Infrastructure Security Practice Question

Correct answer & explanation

Option B is correct. Network ACLs are stateless, meaning that return traffic must be explicitly allowed. The outbound rule only allows all traffic, but the inbound rule denies SSH from 0.0.0.0/0, which would block the return traffic for the SSH session because the source of the response is the instance, not the bastion host. Actually, the issue is that the inbound rule denies SSH from all, but the allow rule for the bastion host should work. However, because NACLs are stateless, the response from the instance to the bastion host would be considered outbound traffic, which is allowed. The real issue is that the NACL rules are evaluated in order; the deny rule (200) might block the bastion host if the allow rule (100) is not matched correctly. But the more likely cause is that the network ACL does not allow ephemeral ports for the return traffic. When the bastion host initiates SSH (source port 22, destination port 22), the response from the instance uses an ephemeral port (1024-65535) as source. The outbound rule allows all traffic, so that should be fine. However, the inbound rule for the ephemeral ports is missing. But the question says the inbound rule denies all SSH, which would block the initial connection from the bastion host? Wait, the inbound rule allows SSH from 10.0.1.10/32, so that should work. The deny rule would block other SSH. The problem might be that the network ACL is not associated correctly. But the most common mistake is forgetting that NACLs are stateless and need rules for ephemeral ports. However, the outbound rule allows all, so that should not be an issue. Let's think: The inbound rule allows SSH from bastion host; the outbound rule allows all. So why would it be blocked? Possibly because the inbound deny rule for SSH from 0.0.0.0/0 also matches the bastion host if the allow rule is not evaluated first? But NACLs are evaluated in order; rule 100 is evaluated before rule 200. So the allow should take precedence. Maybe the issue is that the network ACL is not associated with the subnet, or the bastion host's IP is not exactly 10.0.1.10. However, the most plausible answer among the options is that the network ACL is not associated with the subnet, but the question says the engineer associated it. Option B says the network ACL is not associated with the subnet, which could be the case if the engineer forgot to associate it. Option A (security group still allows SSH from 0.0.0.0/0) would not cause blocking. Option C (outbound rule denies ephemeral ports) is incorrect because outbound is allow all. Option D (NACL rules are out of order) is plausible but the order is correct. Given typical exam logic, the most common mistake is forgetting to associate the NACL. So I'll go with B.

Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.