Which Network ACL Rule Set Allows TLS 443 and Denies MySQL 3306?

SCS-C03 By islever Editorial Last updated

Design and implement network security controls.

Short answer

B Deny inbound TCP 3306 at rule 100, allow inbound TCP 1024–65535 at rule 200 for TLS return traffic, and allow outbound TCP 443.

Question

A public subnet contains two Amazon EC2 instances. The subnet has a custom network ACL. A security engineer is designing a solution to improve the subnet security.
The solution must allow outbound traffic to an internet service that uses TLS through port 443. The solution also must deny inbound traffic that is destined for MySQL port 3306.
Which network ACL rule set meets these requirements?
  1. Use inbound rule 100 to allow traffic on TCP port 443. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
  2. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port range 1024-65535. Use outbound rule 100 to allow traffic on TCP port 443. Correct Answer
  3. Use inbound rule 100 to allow traffic on TCP port range 1024-65535. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
  4. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port 443. Use outbound rule 100 to allow traffic on TCP port 443.

Key Takeaways

The exam tests NACL rule order and stateless return traffic; the trap is allowing inbound TCP 443 instead of the client's ephemeral port range, or placing a broad allow before the 3306 deny.

This SCS-C03 network ACL question tests stateless return traffic for outbound TLS 443 and an explicit inbound MySQL 3306 deny. The page establishes that option B is correct because the 3306 deny is evaluated before the ephemeral-port allow.

Common mistake: Many candidates choose C, not realizing that inbound rule 100's TCP 1024–65535 allow matches MySQL 3306 first, so the deny at rule 200 is never evaluated.

Expert Analysis

Why the Answer Is Correct

A network ACL is stateless, so the engineer must explicitly permit both the outbound TLS request to TCP 443 and the inbound response. In option B, outbound rule 100 allows TCP 443 to the internet service, while inbound rule 200 allows TCP 1024–65535 so the response can reach the EC2 instance's ephemeral source port. Because inbound rule 100 denies TCP 3306 before the broader ephemeral allow is evaluated, the MySQL deny is effective. This combination satisfies both requirements without opening MySQL.

Why the Other Options Are Wrong

Option A allows inbound 443, but the return packet for an outbound TLS connection is addressed to an ephemeral client port, not 443, so the response is dropped. Option C places the broad inbound allow at rule 100, so TCP 3306 matches that allow before the deny at rule 200 and MySQL is not blocked. Option D pairs the correct 3306 deny with an inbound allow for 443, which again fails to permit the ephemeral return traffic. Only B orders the deny before the broad allow while also permitting outbound 443.

Community Comment Notes

gonzales captures the core mechanics: "Outbound must allow destination TCP 443" and inbound must allow the client's ephemeral return range, with the explicit deny ordered before broader allows. 7f6aef's Spanish-language breakdown reaches the same conclusion, noting that inbound 1024–65535 permits return TLS traffic except 3306 because rule 100 blocks it first. Both comments therefore support option B over the superficially similar C. That consensus aligns with the NACL evaluation order and stateless behavior.

Official Reference

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a NACL question involves an outbound connection, immediately identify the inbound ephemeral return range and check whether any deny rule is numbered before a broad allow. Lowest rule number wins, so a deny at 200 is useless if a 100 allow already matches the blocked port.

Frequently Asked Questions

Why does option B allow inbound TCP 1024–65535 instead of TCP 443 for the TLS response?

NACLs are stateless: the return packet for an outbound TLS connection is destined to the EC2 instance's ephemeral source port, not to port 443.

Why is option C invalid if it also includes a deny for MySQL port 3306?

Its inbound rule 100 allows TCP 1024–65535 first, and NACLs evaluate the lowest rule number first, so MySQL 3306 is allowed before rule 200 can deny it.

More SCS-C03 FAQ →

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. 7f6aef3 👍 1 Answered B
    Inbound 100: deny 3306 → se evalúa primero, bloquea MySQL entrante. ✔ Inbound 200: allow 1024-65535 → permite el tráfico de retorno del TLS saliente (excepto 3306, ya bloqueado por la regla 100). ✔ Outbound 100: allow 443 → permite la conexión TLS saliente. ✔
  2. gonzales 👍 1 Answered B
    Outbound must allow destination TCP 443, Inbound must allow the return traffic on the client’s ephemeral port range, typically TCP 1024–65535. Explicit deny to appear before broader allows (C is wrong)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How should a secured S3 CloudFormation template be shared across AWS Organizations?

S-grade

How to enforce MFA for AWS CLI EC2 commands?

S-grade

How Do You Disable a Compromised IAM Identity Center User and Audit Activity?

S-grade

How to Find S3 Buckets with Sensitive Data Using Macie with Least Overhead?

S-grade

Practice All SCS-C03 Questions

Access 86 questions with complete answers and detailed explanations.

View Full SCS-C03 Practice Test →

← Back to SCS-C03 Study Guide