A CloudOps administrator launches an Amazon EC2 instance in a private subnet of a VPC. When the CloudOps administrator attempts a curl command from the command line of the EC2 instance, the CloudOps administrator cannot connect to https:www.example.com. What should the CloudOps administrator do to resolve this issue?
Show Answer & Explanation
Correct Answer: A. Ensure that there is an outbound security group for port 443 to 0.0.0.0/0.
The curl command to https://www.example.com uses HTTPS protocol on port 443, requiring outbound connectivity from the EC2 instance. Security groups are stateful, meaning if outbound traffic is allowed, the return traffic is automatically permitted regardless of inbound rules. For the instance to initiate an HTTPS connection, the security group must have an outbound rule allowing port 443 to 0.0.0.0/0 (or at minimum to the destination). The inbound security group rule for port 443 is incorrect because the instance is initiating the connection outbound, not receiving inbound HTTPS requests. The outbound NACL for ephemeral ports would handle return traffic in a stateless NACL configuration, but security groups are the first layer to check and are stateful, making this answer less relevant to the immediate issue. The outbound NACL for port 80 is incorrect because HTTPS uses port 443, not port 80 (which is HTTP). Note: This answer assumes the private subnet already has proper routing (via NAT Gateway/Instance) to reach the internet; without that infrastructure, even correct security group rules won't resolve connectivity issues.