Examkin

Question

Difficulty: MediumVPC Network Security

A company runs a backend database tier on Amazon EC2 instances in a private database subnet with CIDR block 10.0.3.0/2410.0.3.0/24. The database instances receive incoming MySQL connections on TCP port 33063306 from application servers in a separate private application subnet with CIDR block 10.0.2.0/2410.0.2.0/24. Additionally, the database instances must periodically initiate outbound connections to download software updates from an external repository over HTTPS (TCP port 443443) via a NAT gateway located in the public subnet (CIDR block 10.0.1.0/2410.0.1.0/24). A solutions architect is configuring a custom network ACL (NACL) for the database subnet to enforce strict security boundaries.

Which configuration changes must the solutions architect apply to the database subnet's custom NACL to allow these connections? (Select TWO.)

  1. An inbound rule allowing TCP traffic on port range 1024−655351024-65535 from source 0.0.0.0/00.0.0.0/0Answer
  2. An outbound rule allowing TCP traffic on port range 1024−655351024-65535 to destination 10.0.2.0/2410.0.2.0/24Answer
  3. C
    An inbound rule allowing TCP traffic on port 443443 from source 0.0.0.0/00.0.0.0/0
  4. D
    An outbound rule allowing TCP traffic on port 33063306 to destination 10.0.2.0/2410.0.2.0/24
  5. E
    An inbound rule allowing TCP traffic on port 33063306 from source 10.0.1.0/2410.0.1.0/24

Answer

An inbound rule allowing TCP traffic on port range 1024−655351024-65535 from source 0.0.0.0/00.0.0.0/0 and an outbound rule allowing TCP traffic on port range 1024−655351024-65535 to destination 10.0.2.0/2410.0.2.0/24.
Network ACLs (NACLs) are stateless, meaning that outbound response traffic must be explicitly allowed by outbound rules, and inbound response traffic must be explicitly allowed by inbound rules. For the database tier to accept MySQL traffic from the application tier, the inbound rule must allow port 33063306 from the application subnet CIDR, and the outbound rule must allow return traffic to the application subnet CIDR on the ephemeral ports (1024−655351024-65535). For the database tier to download updates from the internet over HTTPS (destination port 443443), the outbound rule must allow traffic to port 443443 for destination 0.0.0.0/00.0.0.0/0, and the inbound rule must allow return traffic from source 0.0.0.0/00.0.0.0/0 on the ephemeral ports (1024−655351024-65535). Therefore, the two correct configurations are the inbound rule allowing ephemeral ports from the internet, and the outbound rule allowing ephemeral ports to the application subnet.

Step-by-Step Solution

1
Analyze the database subnet traffic flows and determine their state characteristics.
Identify two inbound flows (MySQL requests from 10.0.2.0/2410.0.2.0/24 on port 33063306, and HTTPS return traffic from 0.0.0.0/00.0.0.0/0 on ephemeral ports) and two outbound flows (MySQL responses to 10.0.2.0/2410.0.2.0/24 on ephemeral ports, and HTTPS requests to 0.0.0.0/00.0.0.0/0 on port 443443).
Because Network ACLs are stateless, both the request and response directions of any connection must be explicitly configured.
2
Determine the correct inbound NACL rules required.
Inbound TCP port 33063306 from source 10.0.2.0/2410.0.2.0/24 must be allowed for incoming requests. Inbound TCP ports 1024−655351024-65535 from source 0.0.0.0/00.0.0.0/0 must be allowed for update responses.
The external update server sends response packets back to the ephemeral ports (1024−655351024-65535) allocated by the database instances, so these ports must be opened inbound.
3
Determine the correct outbound NACL rules required.
Outbound TCP port 443443 to destination 0.0.0.0/00.0.0.0/0 must be allowed for requests. Outbound TCP ports 1024−655351024-65535 to destination 10.0.2.0/2410.0.2.0/24 must be allowed for database responses.
The database instances send MySQL response packets back to the application servers on their ephemeral ports (1024−655351024-65535), which requires an outbound NACL rule.

Key Concept

Network ACLs are stateless firewalls operating at the subnet level. They require rules to be configured for both inbound and outbound traffic paths, including allowing return traffic on ephemeral port ranges (1024−655351024-65535).
Estimated Time:2m 0s
Rate this question

Topics

VPC Network Security

More questions from this topic