Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

An IoT company deploys telemetry collection servers on Amazon EC2 instances within a custom subnet. The cloud practitioner configures a Network Access Control List (Network ACL) at the subnet level to allow inbound TCP traffic on port 8883 from the internet. Although the EC2 instances' Security Groups are configured to allow all outbound traffic, the external sensors are unable to receive acknowledgment responses from the servers. Which of the following configuration changes is required to resolve this issue and allow the acknowledgment traffic back to the sensors?

  1. Add an outbound rule to the subnet's Network ACL that allows traffic to the ephemeral port range of the external sensors.Answer
  2. B
    Add an outbound rule to the EC2 instances' Security Group to allow return traffic on the ephemeral port range.
  3. C
    Submit a ticket to AWS Support requesting that they open outbound ephemeral ports on the underlying physical switches of the VPC.
  4. D
    Enable Amazon GuardDuty at the subnet level to identify and automatically remediate the blocked ports on the virtual router.

Answer

Add an outbound rule to the subnet's Network ACL that allows traffic to the ephemeral port range of the external sensors.
The correct option is correct because Network ACLs are stateless firewalls operating at the subnet level. They evaluate inbound and outbound rules independently. When inbound traffic is allowed on port 8883, the return traffic destined for the client's ephemeral ports will be blocked unless an outbound rule explicitly allows it. Security Groups, on the other hand, are stateful and do not block this return traffic.

Step-by-Step Solution

1
Analyze the network security configuration and traffic behavior.
The inbound traffic reaches the EC2 instances successfully, but the outbound return traffic is blocked at the subnet boundary.
Since the Security Group is stateful, it automatically permits return traffic. The failure must be occurring at the Network ACL, which controls subnet-level traffic.
2
Apply the rule characteristics of Network ACLs vs. Security Groups.
Network ACLs are stateless. Therefore, allowing inbound traffic on port 8883 does not automatically allow the outbound return traffic.
An explicit outbound rule must be configured in the Network ACL to allow the return traffic (typically using ephemeral ports) back to the client.

Key Concept

Stateful vs. Stateless Firewalls in AWS (Security Groups vs. Network ACLs)
Estimated Time:1m 30s
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic