Exam AWS-SysOps topic 1 question 253 discussion

After some headache, I try to understand based on answers. DB connects to NAT from private subnet(20.0.1.0/24) for Internet connection thru http/https(ie,.80 or 443 ).So that , DB instance should be allowed as inbound in NAT SG. Hence A is required. Now NAT SG connects to internet(0.0.0.0) thru 80/443 which is Outbound.Hence B & D are Required. Remaining option C, which mentioned public subnet. it can be ignored.

ince the NAT instance is not intended to receive inbound traffic from the public subnet, this inbound rule is not necessary for the NAT security group. The primary purpose of the NAT instance is to handle outbound traffic and provide internet connectivity to the resources in the private subnet.

C correct: Reason: NAT instance is not used for inbound traffic from internet to reach public subnet, so, It is not required rule: "Inbound allow Source: 20.0.0.0/24 on port 80" because if there is a webserver on port 80, it will use another way for inbound traffic like EIP, ELB, CloudFront, API Gateway. A is required: DB instance in private subnet will send request to NAT instance from 20.0.0.0/24 to port 80 and port 443, so, the NAT instance should be allowed as inbound in NAT SG. B & D are Required: Now NAT SG connects to internet (0.0.0.0) using 80/443 which is Outbound. Outbound allow Destination: 0.0.0.0/0 on port 80 and Outbound allow Destination: 0.0.0.0/0 on port 443

This question is a little confusing. I understand that C is the more correct answer but taken within context of the question we also don't need port 443 rules or need to allow traffic to and from on port 80 with the private subnet. It seems like this question is testing for general best practices for NAT instances rather than this specific scenario.

Answer is A

C. For Inbound allow Source: 20.0.0.0/24 on port 80