Examkin

Question

Difficulty: HardVPC Network Security

A company hosts a two-tier web application in a VPC. The web servers are deployed in a public subnet (10.0.1.0/2410.0.1.0/24) and receive HTTPS traffic from the internet. The database servers are deployed in a private subnet (10.0.2.0/2410.0.2.0/24) and accept MySQL connections from the web servers on TCP port 3306.

A security architect configures custom network ACLs (NACLs) to secure both subnets.
The public subnet NACL is configured with the following rules:
* Inbound: Allow TCP port 443 from 0.0.0.0/00.0.0.0/0
* Outbound: Allow TCP port 443 to 0.0.0.0/00.0.0.0/0, and allow TCP port 3306 to 10.0.2.0/2410.0.2.0/24

The private subnet NACL is configured with the following rules:
* Inbound: Allow TCP port 3306 from 10.0.1.0/2410.0.1.0/24
* Outbound: Allow TCP ports 1024−655351024-65535 to 10.0.1.0/2410.0.1.0/24

The security groups for both the web servers and database servers are already correctly configured to allow the necessary inbound and outbound traffic. Currently, external clients cannot establish HTTPS connections to the web servers, and the web servers are unable to connect to the database.

Which combination of NACL modifications will resolve these connectivity issues?

  1. In the public subnet NACL, add an inbound rule allowing TCP ports 1024−655351024-65535 from 10.0.2.0/2410.0.2.0/24, and update the outbound rule to allow TCP ports 1024−655351024-65535 to 0.0.0.0/00.0.0.0/0 instead of TCP port 443.Answer
  2. B
    In the private subnet NACL, add an inbound rule allowing TCP ports 1024−655351024-65535 from 10.0.1.0/2410.0.1.0/24, and in the public subnet NACL, update the inbound rule to allow TCP ports 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.
  3. C
    In the public subnet security group, add an inbound rule allowing TCP ports 1024−655351024-65535 from the private subnet, and in the private subnet NACL, change the outbound rule to allow TCP port 3306 to 10.0.1.0/2410.0.1.0/24.
  4. D
    In the public subnet NACL, add an outbound rule allowing TCP port 3306 to 0.0.0.0/00.0.0.0/0, and in the private subnet NACL, remove the outbound rule for ephemeral ports since security groups are stateful and will automatically track return traffic.

Answer

In the public subnet NACL, add an inbound rule allowing TCP ports 1024−655351024-65535 from 10.0.2.0/2410.0.2.0/24, and update the outbound rule to allow TCP ports 1024−655351024-65535 to 0.0.0.0/00.0.0.0/0 instead of TCP port 443.
The correct option correctly addresses the stateless nature of Network ACLs. When a client establishes an HTTPS connection to the web server, the inbound rule allows port 443, but the return response from the web server must be allowed to go to the client's ephemeral ports (1024−655351024-65535). Therefore, the public subnet outbound rule must allow TCP ports 1024−655351024-65535 to 0.0.0.0/00.0.0.0/0. Additionally, when the web server initiates a connection to the database on port 3306, the database responses return to the web server's ephemeral ports. Thus, the public subnet NACL must allow inbound traffic on TCP ports 1024−655351024-65535 from the private subnet (10.0.2.0/2410.0.2.0/24).

Step-by-Step Solution

1
Analyze client-to-web server HTTPS traffic flow.
Inbound HTTPS traffic to the web server targets port 443. The return traffic sent back to the client targets the client's ephemeral ports (range 1024−655351024-65535).
NACLs are stateless, so the outbound path must explicitly allow the response traffic to client ephemeral ports.
2
Analyze web server-to-database MySQL traffic flow.
The web server initiates connection to the database on port 3306. The database responds back to the web server's ephemeral ports (range 1024−655351024-65535).
Since the web server is in the public subnet and the database is in the private subnet, the public subnet NACL must explicitly allow inbound traffic from the database subnet on destination ports 1024−655351024-65535.
3
Determine the necessary modifications on the public subnet NACL.
Update the outbound rule to allow TCP ports 1024−655351024-65535 to 0.0.0.0/00.0.0.0/0 (instead of restricting to port 443), and add an inbound rule to allow TCP ports 1024−655351024-65535 from the private subnet CIDR (10.0.2.0/2410.0.2.0/24).
These changes ensure that both HTTPS client responses and database responses can bypass the stateless boundaries of the public subnet NACL.

Key Concept

Stateless Network ACLs (NACLs) require explicit rules for both request and response traffic, including accounting for client and initiator ephemeral ports.
Rate this question

Topics

VPC Network Security

More questions from this topic