VPC - Access Control Lists (ACLs)

Question 1

Can Subnets / Availability Zones span multiple Network ACLs?

Answer 1

No, but the reverse is possible.

Question 2

What traffic does the default Network ACL allow?

Answer 2

All traffic inbound and outbound.

Question 3

What traffic does a new Network ACL allow?

Answer 3

No traffic inbound or outbound.

Question 4

When you create a standard Network ACL for connecting to the Internet, why might it not connect right away?

Answer 4

You will need another rule that opens up ephemeral ports in order to cover the different types of clients that might initiate traffic to the public-facing instances in your VPC

Question 5

T/F: Each subnet in your VPC must be associated with a Network ACL.

Answer 5

True

Question 6

If you don’t explicitly associate a subnet with a network ACL…

Answer 6

…the subnet is automatically associated with the default network ACL

Question 7

When you associate a network ACL with a subnet…

Answer 7

…the previous association is removed.

Question 8

How are the rules in a Network ACL evaluated?

Answer 8

Numerical order starting with the lowest number

Question 9

When blocking specific IPs…

Answer 9

…use network ACLs not security groups