Examkin

Question

Difficulty: HardNetwork and Infrastructure Security

A systems administrator is troubleshooting a connectivity issue for a web application deployed on Amazon EC2 instances within a custom VPC subnet. The instances are associated with a stateful Security Group that allows inbound HTTP (port 80) traffic from any source, and allows all outbound traffic. At the subnet level, the custom Network Access Control List (Network ACL) is configured with an inbound rule allowing HTTP (port 80) traffic from any source, but its outbound rule set only contains the default deny rule. Users report that they receive connection timeouts when trying to access the web application. Which of the following explains why the connection attempts are timing out?

  1. A
    The Security Group is stateless, meaning the outbound rule allowing all traffic only applies to new connections initiated by the instance, not return traffic.
  2. B
    Under the AWS Shared Responsibility Model, AWS automatically manages all subnet-level outbound security filtering, requiring the customer to only configure instance-level Security Groups.
  3. The Network ACL is stateless, which means it does not automatically allow return traffic; an outbound rule must be added to allow traffic to the clients' ephemeral ports.Answer
  4. D
    Amazon GuardDuty automatically blocks outbound HTTP traffic at the subnet level until Amazon Inspector performs a vulnerability scan on the EC2 instances.

Answer

The Network ACL is stateless, which means it does not automatically allow return traffic; an outbound rule must be added to allow traffic to the clients' ephemeral ports.
The correct answer is correct because Network Access Control Lists (Network ACLs) are stateless. Even though the inbound HTTP traffic is allowed and the instance's Security Group is stateful (allowing return traffic automatically at the instance level), the stateless Network ACL blocks the return traffic because it does not track connection states. Therefore, an outbound rule must be explicitly added to the Network ACL to allow the web server's responses to reach the clients' ephemeral ports (typically 1024-65535).

Step-by-Step Solution

1
Analyze the stateful nature of the Security Group associated with the EC2 instances.
The Security Group is stateful, so inbound HTTP traffic on port 80 is allowed, and its response traffic is automatically allowed outbound at the instance level.
To determine if the traffic is blocked at the instance boundary.
2
Analyze the stateless nature of the Network ACL associated with the subnet.
The Network ACL is stateless, which means outbound return traffic is not tracked or automatically allowed, even if the corresponding inbound traffic was permitted.
To check if the subnet boundary is blocking the return traffic.
3
Identify the missing configuration in the Network ACL outbound rules.
The outbound rule set only contains the default deny rule, blocking response packets sent to client ephemeral ports (typically 1024-65535). An explicit outbound rule is required.
To resolve the connection timeout by allowing the server to respond to the client.

Key Concept

Stateful vs. Stateless network security controls in AWS VPC
Estimated Time:2m 0s
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic