A company's backend application runs on Amazon EC2 instances inside a private subnet. The … — AWS Certified Solutions Architect - Associate

A company's backend application runs on Amazon EC2 instances inside a private subnet. The application is required to call a partner's external API endpoint at a static public IP address ( $203.0.113.50$ ) using HTTPS. The private subnet is associated with a custom network ACL (NACL) that currently denies all inbound and outbound traffic. The security groups associated with the EC2 instances already allow all outbound HTTPS traffic.

Which configuration of rules must be added to the custom NACL to allow the EC2 instances to successfully establish connections to the external API?

A
An outbound rule allowing traffic to destination $203.0.113.50/32$ on TCP port $443$ . No inbound rule is required because network ACLs automatically allow return traffic for established connections.
B
An outbound rule allowing traffic to destination $203.0.113.50/32$ on TCP port $443$ , and an inbound rule allowing traffic from source $203.0.113.50/32$ on TCP port $443$ .
An outbound rule allowing traffic to destination $203.0.113.50/32$ on TCP port $443$ , and an inbound rule allowing traffic from source $203.0.113.50/32$ on TCP ports $1024-65535$ .Answer
D
An outbound rule allowing traffic to destination $203.0.113.50/32$ on TCP ports $1024-65535$ , and an inbound rule allowing traffic from source $203.0.113.50/32$ on TCP port $443$ .

Answer

An outbound rule allowing traffic to destination

203.0.113.50/32

on TCP port

443

, and an inbound rule allowing traffic from source

203.0.113.50/32

on TCP ports

1024-65535

The correct configuration requires allowing outbound traffic to the destination IP address on TCP port

443

, because the EC2 instances are initiating HTTPS requests. Since network ACLs are stateless, they do not automatically track connections or allow return traffic. Therefore, an inbound rule is also required. This inbound rule must allow traffic from the partner's IP address (acting as the source) on TCP source port

443

returning to the EC2 instances' ephemeral destination ports (TCP

1024-65535

Step-by-Step Solution

Analyze the direction and target ports of the initial request.

The EC2 instances initiate outbound HTTPS connections. This requires an outbound NACL rule allowing traffic to the destination IP address

203.0.113.50/32

on destination TCP port

443

Network ACLs are stateless, so both the initiating request and the return response must be explicitly permitted by distinct rules.

Determine the destination ports for the returning network traffic.

When a client initiates a TCP connection, the operating system allocates an ephemeral source port from the range

1024-65535

. The remote server sends the response back to this ephemeral port.

To allow the response to enter the subnet, an inbound NACL rule must permit traffic from the source IP address

203.0.113.50/32

originating from source port

443

and targeting the destination ephemeral port range

1024-65535

on the EC2 instances.

Combine the rules to form the complete stateless configuration.

The final network ACL configuration must contain the outbound port

443

rule and the inbound ephemeral ports rule.

Without both rules, either the connection request will be blocked on egress, or the return response will be blocked on ingress.

Key Concept

Stateless Network ACLs and Ephemeral Ports

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic