Exam AWS Certified SysOps Administrator - Associate topic 1 question 384 discussion

No. It's C. In this sinario, there are 2 cases. 1. When accessing from outside: Blocked by default security group 2. When taking from inside: Default security group did not succeed. There is Ado Since 2 does not correspond to anything, it should be considered as 1 only, so C is appropriate. I understood that using the custom network ACL meant that the firewall was allowed. And the default security group originally had no settings. So I had to allow inbound in the security group. So I chose C. Even if the custom network ACL is incorrect and is reset, access is not possible if the security group does not allow it.

Agree with LudiVoss

It is A, default security groups don't block anything so it can only be in ACL.

A is the best one.

There is a network ACL on the private subnet set to deny all outbound traffic. Network ACLs (Access Control Lists) are stateless and operate at the subnet level. If there is a network ACL on the private subnet that is configured to deny all outbound traffic, it would prevent instances in the private subnet from accessing the internet through the NAT gateway.