Examkin

Question

Difficulty: Very hardNetwork and Infrastructure Security

A company's backend application instances in Subnet A must query a PostgreSQL database running on an Amazon EC2 instance in Subnet B. To secure this traffic, a network administrator is configuring network access control lists (Network ACLs) for Subnet B and a security group for the database instance. Which two configuration steps are required to allow this database traffic while maintaining the principle of least privilege? (Select TWO.)

  1. Add a security group rule to the database instance that allows inbound TCP traffic on port 5432 from the application instances.Answer
  2. Add an outbound rule to the Network ACL of Subnet B that allows TCP traffic on ephemeral ports 1024–65535 to Subnet A.Answer
  3. C
    Add an outbound rule to the database instance's security group that allows TCP traffic on ephemeral ports 1024–65535 to Subnet A.
  4. D
    Add an outbound rule to the Network ACL of Subnet B that allows TCP traffic on port 5432 to Subnet A.
  5. E
    Attach an IAM policy to the database instance that permits inbound network connections on port 5432 from the application server's IAM role.

Answer

The correct configurations are to add an inbound security group rule on port 5432 from the application instances, and to add a Network ACL outbound rule on the database subnet allowing ephemeral port traffic to the application subnet.
The correct configurations are adding an inbound security group rule on the database instance for port 5432, and adding an outbound Network ACL rule on the database subnet for ephemeral ports. Security groups are stateful, meaning they track connection states and automatically allow return traffic for established inbound connections. Network ACLs are stateless, meaning every packet must be evaluated against rules. When a client initiates a connection to a database, the return traffic is sent from the database to the client's ephemeral ports (ranging from 1024 to 65535). Therefore, the stateless Network ACL must explicitly permit outbound traffic to these ephemeral ports.

Step-by-Step Solution

1
Analyze the stateful behavior of Security Groups at the instance level.
Identify that allowing inbound database traffic on port 5432 automatically allows the return traffic outbound, making additional outbound rules for this traffic on the Security Group unnecessary.
Security Groups are stateful firewalls.
2
Analyze the stateless behavior of Network ACLs at the subnet level.
Determine that both inbound and outbound traffic must be explicitly allowed. For database responses, the return traffic is sent to the ephemeral ports of the application servers.
Network ACLs are stateless and require explicit rules for return traffic.
3
Evaluate the role of IAM policies vs. network security controls.
Recognize that network-level packet filtering is handled by Security Groups and Network ACLs, not by IAM roles or policies.
IAM controls API and resource authorization, not TCP/IP network packet filtering.

Key Concept

Distinguishing between the stateful behavior of Security Groups at the instance level and the stateless behavior of Network ACLs at the subnet level.
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic