A company hosts a secure API on Amazon EC2 instances in a private subnet (10.0.2.0/24). Th… — AWS Certified Solutions Architect - Associate

A company hosts a secure API on Amazon EC2 instances in a private subnet ( $10.0.2.0/24$ ). The instances receive incoming HTTPS requests forwarded by an Application Load Balancer (ALB) located in the public subnets ( $10.0.1.0/24$ ). The instances also initiate outbound HTTPS connections to an external payment processor's API on the internet ( $0.0.0.0/0$ ). The solutions architect is configuring a custom Network Access Control List (NACL) for the private subnet. Which TWO rule configurations must be added to the custom NACL to allow this traffic while maintaining the principle of least privilege? (Select TWO.)

Inbound rule: Allow TCP port $443$ from source $10.0.1.0/24$ . Outbound rule: Allow TCP ports $1024$ - $65535$ to destination $10.0.1.0/24$ .Answer
Outbound rule: Allow TCP port $443$ to destination $0.0.0.0/0$ . Inbound rule: Allow TCP ports $1024$ - $65535$ from source $0.0.0.0/0$ .Answer
C
Inbound rule: Allow TCP port $443$ from source $10.0.1.0/24$ . Outbound rule: None required, as Network ACLs are stateful and return traffic is allowed automatically.
D
Outbound rule: Allow TCP port $443$ to destination $0.0.0.0/0$ . Inbound rule: None required, as the stateful Security Group associated with the instances overrides Network ACL statelessness.
E
Inbound rule: Configure AWS Shield Standard to inspect Layer $7$ headers from source $10.0.1.0/24$ . Outbound rule: Allow TCP port $443$ to destination $0.0.0.0/0$ .

Answer

The correct configurations are the rules allowing inbound TCP port

443

from the public subnet with outbound ephemeral port access to the public subnet, and outbound TCP port

443

to the internet with inbound ephemeral port access from the internet.

Because Network ACLs are stateless, rules must be explicitly configured for both request and response paths. For the inbound flow from the ALB, the request arrives on destination port

443

and the response returns to the ALB's ephemeral source ports (

1024

65535

). For the outbound flow to the external gateway, the request goes to destination port

443

and the response returns to the instances' ephemeral source ports (

1024

65535

). Thus, both options representing these configurations must be selected.

Step-by-Step Solution

Analyze the direction of traffic for the inbound requests from the ALB.

The ALB in

10.0.1.0/24

communicates with the application instances on TCP port

443

. Because Network ACLs are stateless, both inbound and outbound paths must be explicitly allowed.

To allow the inbound request, an inbound rule permitting TCP port

443

from source

10.0.1.0/24

is needed. To allow the response back to the ALB's ephemeral ports, an outbound rule permitting TCP ports

1024

65535

to destination

10.0.1.0/24

must be created.

Analyze the direction of traffic for the outbound connections to the external payment processor.

The application instances initiate outbound connections on TCP port

443

to destination

0.0.0.0/0

. Because Network ACLs are stateless, both outbound and inbound paths must be explicitly allowed.

To allow the outbound request, an outbound rule permitting TCP port

443

to destination

0.0.0.0/0

is needed. To allow the response back from the external gateway, an inbound rule permitting TCP ports

1024

65535

from source

0.0.0.0/0

must be created.

Evaluate the other options to verify why they are incorrect.

Options suggesting Network ACLs are stateful, or that Security Groups override Network ACLs, or that AWS Shield Standard provides Layer

7

inspection at the NACL level are invalid.

Network ACLs are strictly stateless, whereas Security Groups are stateful. Both are evaluated, and one cannot override the other. AWS Shield Standard operates at layers

3

and

4

for DDoS protection and is not configured in NACL rules.

Key Concept

Network Access Control Lists (NACLs) are stateless firewall rules applied at the subnet level, meaning that outbound response traffic must be explicitly permitted for allowed inbound requests, and inbound response traffic must be explicitly permitted for allowed outbound requests.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic