Examkin

Question

Difficulty: HardVPC Network Security

An application is deployed on Amazon EC2 instances inside a private subnet (CIDR 10.0.2.0/2410.0.2.0/24) of an Amazon VPC. The application must regularly download large datasets from Amazon S3 and invoke a public, third-party payment gateway API over the internet. A public subnet (CIDR 10.0.1.0/2410.0.1.0/24) in the VPC contains a NAT Gateway. A Gateway VPC Endpoint for Amazon S3 has already been created for the VPC. Security policies require strict control over outbound traffic, minimal data processing charges, and the enforcement of the principle of least privilege. Which TWO configurations are required to establish secure, cost-effective connectivity for the application?

  1. Update the private subnet route table to direct traffic destined for the Amazon S3 prefix list to the S3 Gateway VPC Endpoint.Answer
  2. Configure the private subnet Network ACL to allow outbound traffic to the payment gateway IP range on port 443443 and allow inbound traffic from the payment gateway IP range on ephemeral ports 10241024-6553565535.Answer
  3. C
    Add an inbound rule to the EC2 instances' Security Group allowing TCP port 443443 traffic from the payment gateway IP range to authorize the returning API response payloads.
  4. D
    Add a route to the private subnet route table that directs Amazon S3 traffic to the NAT Gateway to ensure all external data transfers are centrally logged.
  5. E
    Associate the S3 Gateway VPC Endpoint with the EC2 instances' Security Group to control and secure traffic flow between the instances and S3.

Answer

Update the private subnet route table to direct traffic destined for the Amazon S3 prefix list to the S3 Gateway VPC Endpoint, and configure the private subnet Network ACL to allow outbound traffic to the payment gateway IP range on port 443443 and allow inbound traffic from the payment gateway IP range on ephemeral ports 10241024-6553565535.
Updating the private subnet route table to target the S3 prefix list via the S3 Gateway VPC Endpoint ensures S3 traffic is routed privately and cost-effectively. Furthermore, configuring the stateless Network ACL with an outbound rule for port 443443 and an inbound rule for ephemeral ports (10241024-6553565535) ensures that outbound API calls can be completed and responses can return.

Step-by-Step Solution

1
Determine the most cost-effective and secure route for Amazon S3 traffic.
A Gateway VPC Endpoint for S3 should be used, requiring an update to the private subnet route table targeting the S3 prefix list.
This keeps traffic within the AWS internal network, reducing NAT Gateway processing costs.
2
Analyze security group requirements for returning HTTPS traffic.
No inbound security group rule is needed for return traffic because security groups are stateful.
Security groups automatically allow return traffic for established outbound sessions.
3
Configure Network ACL rules for the stateless subnet boundary.
Add an outbound rule for port 443443 and an inbound rule for ephemeral ports 10241024-6553565535 for the payment gateway IP range.
Network ACLs are stateless, meaning return traffic must be explicitly allowed by specifying inbound rules for ephemeral ports.

Key Concept

VPC Network Security design balancing stateful security groups, stateless Network ACLs, and Gateway VPC Endpoint routing.
Estimated Time:2m 0s
Rate this question

Topics

VPC Network Security

More questions from this topic