Examkin

Question

Difficulty: MediumVPC Network Security

A company has two VPCs in the same AWS Region: VPC A with CIDR block 10.0.0.0/1610.0.0.0/16 hosting client applications in a private subnet, and VPC B with CIDR block 192.168.0.0/16192.168.0.0/16 hosting a centralized directory service in another private subnet. A VPC Peering connection is active between VPC A and VPC B. The client applications in VPC A must query the directory service in VPC B on TCP port 389389. The security team requires a multi-layered security approach: network ACLs must secure the subnets (stateless), and security groups must secure the instances (stateful) to permit only this specific traffic. Which combination of actions will meet these requirements? (Select TWO.)

  1. Configure the network ACL for the client subnets in VPC A to allow outbound TCP port 389389 to the VPC B CIDR block, and allow inbound TCP traffic on ephemeral ports (1024−655351024-65535) from the VPC B CIDR block.Answer
  2. Configure the security group for the directory service instances in VPC B to allow inbound TCP port 389389 from the security group of the client applications in VPC A.Answer
  3. C
    Configure the network ACL for the client subnets in VPC A to allow outbound TCP port 389389 to the VPC B CIDR block, without adding any inbound rules for return traffic.
  4. D
    Configure the security group for the directory service instances in VPC B to allow inbound TCP port 389389 from the client security group, and configure an outbound rule in the same security group to allow TCP traffic on ephemeral ports (1024−655351024-65535) back to VPC A.
  5. E
    Configure AWS Shield Advanced on the VPC Peering connection to inspect and permit TCP port 389389 traffic while blocking all other ports at the VPC edge.

Answer

Configure the network ACL for the client subnets in VPC A to allow outbound TCP port 389389 to the VPC B CIDR block, and allow inbound TCP traffic on ephemeral ports (1024−655351024-65535) from the VPC B CIDR block; and configure the security group for the directory service instances in VPC B to allow inbound TCP port 389389 from the security group of the client applications in VPC A.
The correct combination of actions consists of configuring the stateless network ACL in VPC A to permit outbound directory traffic on port 389389 and inbound return traffic on ephemeral ports (1024−655351024-65535), while setting the stateful security group on the destination instances in VPC B to accept inbound port 389389 connections from the clients.

Step-by-Step Solution

1
Analyze the stateful nature of security groups at the instance level.
The directory service instances in VPC B require an inbound security group rule to permit TCP port 389389 from the client security group in VPC A. Since security groups are stateful, return traffic is allowed automatically.
Security groups operate at the instance level and automatically track connection state, allowing response traffic without explicit outbound rules.
2
Analyze the stateless nature of network ACLs at the subnet level.
The subnets in VPC A require a network ACL outbound rule to allow TCP port 389389 to VPC B, and an inbound rule to allow return traffic on ephemeral ports (1024−655351024-65535) from VPC B.
Network ACLs operate at the subnet level and are stateless, meaning return traffic must be explicitly permitted in the opposite direction.

Key Concept

VPC network security involves configuring stateful security groups at the instance level and stateless network ACLs at the subnet level, ensuring both inbound and return path traffic are appropriately allowed or denied.
Rate this question

Topics

VPC Network Security

More questions from this topic