A custom network ACL has rule #100 denying all traffic from 203.0.113.0/24, and rule #200 allowing all inbound traffic from 0.0.0.0/0. A request arrives from an address inside 203.0.113.0/24. What happens?
- The traffic is allowed because rule #200 covers a broader range and takes priority
- The traffic is denied because NACL rules are evaluated in ascending numeric order and the first match applies
- Both rules apply and their effects are combined, resulting in a partial allow
- The traffic is allowed because more specific CIDR ranges are always evaluated last
Correct answer: B. The traffic is denied because NACL rules are evaluated in ascending numeric order and the first match applies
Network ACLs process their numbered rules in ascending order and stop at the first rule that matches the traffic; whatever that rule specifies, allow or deny, is final for that packet, and no later rule is ever consulted. Here rule #100 matches first because its CIDR includes the source address, so its deny takes effect immediately, and rule #200 is never reached even though it would otherwise authorize the traffic. Option A wrongly imagines a priority based on rule scope; NACLs have no such concept, since rule number order is what governs evaluation, not how broad or narrow a rule's CIDR happens to be. Option C is wrong because only one rule ever applies per packet; NACLs never merge the effects of multiple matching rules. Option D invents a specificity-based ordering that network ACLs simply do not use, unlike some other stateful firewall products.
Source: AWS VPC docs: Network ACLs — evaluating rules