Examkin

Question

Difficulty: HardNetwork and Infrastructure Security

An organization is securing a proprietary database tier hosted on Amazon EC2 instances within a private subnet of a Virtual Private Cloud (VPC). The database must receive SQL traffic on TCP port 33063306 from the application servers located in a public subnet, while ensuring strict network isolation at both the subnet and instance levels. Which two configuration steps are required to establish this network security architecture? (Select TWO.)

  1. Configure the database security group with an inbound rule allowing TCP port 33063306 from the application security group, and rely on its stateful nature to automatically permit outbound response traffic.Answer
  2. Configure the private subnet Network ACL with an inbound rule allowing TCP port 33063306 from the public subnet CIDR, and an outbound rule allowing TCP ports 10241024-6553565535 to the public subnet CIDR.Answer
  3. C
    Configure the private subnet Network ACL with an inbound rule allowing TCP port 33063306, relying on its stateful monitoring to automatically handle response traffic without an outbound rule.
  4. D
    Configure the database security group with both an inbound rule allowing TCP port 33063306 and a manual outbound rule allowing ephemeral ports to return database responses.
  5. E
    Enable Amazon GuardDuty at the private subnet border to inspect and filter individual packets, since AWS manages subnet security under the shared responsibility model.

Answer

Configuring the database security group with an inbound rule allowing TCP port 33063306 from the application security group (leveraging its stateful tracking), and configuring the private subnet Network ACL with an inbound rule allowing TCP port 33063306 and an outbound rule allowing TCP ephemeral ports 10241024-6553565535.
Security groups operate at the instance level and are stateful. When you add an inbound rule allowing TCP port 33063306 from the application security group, the return traffic is automatically permitted outbound, regardless of outbound rules. Network ACLs operate at the subnet level and are stateless. This means that both inbound traffic (port 33063306) and outbound response traffic (ephemeral ports 10241024-6553565535) must be explicitly allowed.

Step-by-Step Solution

1
Determine instance-level security requirements using Security Groups.
A Security Group rule must allow inbound database traffic on port 33063306 from the source application tier. Because Security Groups are stateful, no outbound rule is needed for return traffic.
Security Groups provide stateful firewall protection at the resource/instance level.
2
Determine subnet-level security requirements using Network ACLs.
The Network ACL must allow inbound TCP traffic on port 33063306 from the public subnet. Additionally, an outbound rule must allow TCP traffic to ephemeral ports 10241024-6553565535 back to the public subnet.
Network ACLs are stateless firewalls at the subnet boundary, meaning outbound return path rules are required.

Key Concept

The key concept is the distinction between stateful Security Groups (operating at the instance level) and stateless Network Access Control Lists (operating at the subnet level) in AWS VPC security.
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic