A company hosts a backend processing application on Amazon EC2 instances in a private VPC … — AWS Certified Solutions Architect - Associate

A company hosts a backend processing application on Amazon EC2 instances in a private VPC subnet with the CIDR block $10.0.2.0/24$ . The instances receive incoming requests on TCP port $8080$ from an Elastic Load Balancer (ELB) situated in a public subnet with the CIDR block $10.0.1.0/24$ . Additionally, the EC2 instances must make outbound HTTPS calls (TCP port $443$ ) to a third-party vendor's API gateway at the public IP address $203.0.113.50/32$ . The private subnet is associated with a custom Network Access Control List (NACL), and the EC2 instances are associated with a stateful security group. To implement the principle of least privilege, the security team requires the custom NACL to be hardened to permit only these specific traffic flows. Which of the following configurations meets these requirements while ensuring successful bidirectional communication?

Inbound Rules: Allow TCP from $10.0.1.0/24$ on Port Range $8080$ , and allow TCP from $203.0.113.50/32$ on Port Range $1024-65535$ . Outbound Rules: Allow TCP to $10.0.1.0/24$ on Port Range $1024-65535$ , and allow TCP to $203.0.113.50/32$ on Port Range $443$ .Answer
B
Inbound Rules: Allow TCP from $10.0.1.0/24$ on Port Range $1024-65535$ , and allow TCP from $203.0.113.50/32$ on Port Range $443$ . Outbound Rules: Allow TCP to $10.0.1.0/24$ on Port Range $8080$ , and allow TCP to $203.0.113.50/32$ on Port Range $1024-65535$ .
C
Inbound Rules: Allow TCP from $10.0.1.0/24$ on Port Range $8080$ , and allow TCP from $203.0.113.50/32$ on Port Range $443$ . Outbound Rules: Allow TCP to $10.0.1.0/24$ on Port Range $8080$ , and allow TCP to $203.0.113.50/32$ on Port Range $443$ .
D
Inbound Rules: Allow TCP from $10.0.1.0/24$ on Port Range $8080$ , and allow TCP from $203.0.113.50/32$ on Port Range $1024-65535$ . Outbound Rules: Allow TCP to $203.0.113.50/32$ on Port Range $443$ , relying on the security group's statefulness to automatically permit the return traffic to the Elastic Load Balancer.

Answer

The configuration that allows inbound TCP from the load balancer subnet on port

8080

and from the vendor API on the ephemeral range (

1024-65535

), while allowing outbound TCP to the load balancer subnet on the ephemeral range (

1024-65535

) and to the vendor API on port

443

The correct configuration properly implements stateless NACL rules by defining the destination ports for both request and response traffic. For inbound connections from the load balancer, the destination port is

8080

, and the return traffic to the load balancer uses the destination ephemeral ports (

1024-65535

). For outbound connections initiated by the EC2 instances, the destination port is

443

, and the return traffic from the API gateway uses the destination ephemeral ports (

1024-65535

) on the EC2 instances.

Step-by-Step Solution

Analyze the inbound flow from the Elastic Load Balancer (ELB) to the EC2 instances.

Incoming packets from

10.0.1.0/24

target destination port

8080

on the EC2 instances. This requires an inbound NACL rule allowing TCP port

8080

from

10.0.1.0/24

NACL rules evaluate the destination port of incoming packets to determine if they are allowed into the subnet.

Analyze the outbound response flow from the EC2 instances back to the ELB.

Response packets sent from the EC2 instances target the ELB's ephemeral source ports. This requires an outbound NACL rule allowing TCP destination port range

1024-65535

10.0.1.0/24

Because NACLs are stateless, outbound response traffic must be explicitly allowed. The destination port of the response packet is the source port used by the client (ELB), which falls in the ephemeral port range.

Analyze the outbound initiation flow from the EC2 instances to the vendor's API gateway.

Outbound requests sent to

203.0.113.50/32

target destination port

443

. This requires an outbound NACL rule allowing TCP port

443

203.0.113.50/32

Outbound NACL rules inspect the destination IP and port of traffic leaving the subnet.

Analyze the inbound response flow from the vendor's API gateway back to the EC2 instances.

Response packets from

203.0.113.50/32

target the ephemeral source ports assigned to the EC2 instances' connections. This requires an inbound NACL rule allowing TCP destination port range

1024-65535

from

203.0.113.50/32

Because NACLs are stateless, return packets from external destinations must be allowed through the inbound rules. The destination of these packets is the ephemeral port allocated by the EC2 host for the connection.

Key Concept

AWS Network Access Control Lists (NACLs) are stateless firewall rules evaluated at the subnet boundary. They evaluate traffic based on the destination port of the packet. For bidirectional communication to succeed, rules must explicitly allow both the request flow (targeting the listener port) and the response flow (targeting the client's ephemeral port range:

1024-65535

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic