SOA-C02 Networking and Content Delivery Practice Question

A SysOps administrator needs to allow traffic from a specific IP address range (203.0.113.0/24) to access an Amazon EC2 instance in a VPC. Which configuration step should be performed?

⚠ Common exam trap

SOA-C02 often tests the confusion between security groups and network ACLs, leading candidates to select network ACLs when the question asks for allowing traffic to a specific EC2 instance.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add an inbound rule to the security group associated with the EC2 instance allowing traffic from 203.0.113.0/24.

Security groups are the stateful, instance-level virtual firewalls in AWS that control inbound and outbound traffic to EC2 instances. To permit traffic from a specific CIDR block like 203.0.113.0/24 to reach an EC2 instance, you must add an inbound rule to the security group attached to that instance, specifying the source as the CIDR. This is the most direct and correct configuration step because security groups operate at the ENI level and are required for any inbound traffic to be allowed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create an IAM policy that allows inbound traffic from 203.0.113.0/24.
Why it's wrong here
IAM policies are JSON documents that grant or deny permissions to AWS API actions, such as ec2:RunInstances or s3:PutObject. They do not inspect or filter network packets, so a policy cannot allow inbound traffic to an EC2 instance. To permit traffic from a CIDR range, you must modify a network-level firewall like a security group or network ACL.
✗
Add a rule to the network ACL associated with the subnet to allow inbound traffic from 203.0.113.0/24.
Why it's wrong here
Network ACLs are stateless, meaning an inbound allow rule does not automatically permit the corresponding outbound response traffic. You would need to add a separate outbound rule to allow the instance's replies to return to 203.0.113.0/24. Additionally, a NACL applies to all instances in the subnet, so it lacks the instance-specific granularity that a security group provides.
✗
Modify the route table of the subnet to include a route for 203.0.113.0/24 to the internet gateway.
Why it's wrong here
Route tables govern the path of outbound traffic leaving a subnet by matching the destination IP address to a route target. Adding a route for 203.0.113.0/24 to an internet gateway would only affect traffic sent from the subnet to that CIDR block, not traffic arriving from that block. Inbound connections are delivered directly to the instance based on the instance's network interface and are not controlled by route table entries.
✓
Add an inbound rule to the security group associated with the EC2 instance allowing traffic from 203.0.113.0/24.
Why this is correct
A security group is a stateful, instance-level virtual firewall that filters traffic at the elastic network interface. Adding an inbound rule that permits 203.0.113.0/24 on the desired port allows that specific source to reach the EC2 instance, and because security groups are stateful, the return traffic is automatically allowed without any additional outbound rule. This provides the most precise and correct method for the stated requirement.

Visual reference

Go deeper

SOA-C02 Networking and Content Delivery Practice Question

Why each option matters

Option-by-option breakdown

Related to this question