Question

A CloudOps engineer is troubleshooting connectivity for an EC2 instance in a private subnet running a web service on port 8080. Instances in the same subnet can reach the service, but a bastion host in a different subnet within the same VPC cannot connect. The instance's security group allows inbound TCP 8080 from the VPC CIDR. The subnet's network ACL has an inbound rule allowing TCP 8080 from the VPC CIDR, but its only outbound rule allows TCP 443 to 0.0.0.0/0. What is the most likely cause of the failure?

Accepted Answer

The network ACL is stateless and lacks an outbound rule permitting the ephemeral port range, so response traffic to the bastion host is blocked.

Answer

The security group is stateful but requires an explicit outbound rule allowing TCP 8080 for the response traffic to leave the instance.

Answer

The bastion host must be in the same subnet as the target instance because network ACLs block all cross-subnet traffic by default.

Answer

The network ACL inbound rule must reference the bastion host's private IP explicitly instead of the VPC CIDR for the connection to succeed.