A cloud-native healthcare platform is deploying an analytics processing engine on AWS. The… — AWS Certified Solutions Architect - Associate

A cloud-native healthcare platform is deploying an analytics processing engine on AWS. The analytics instances reside in a private Analytics Engine Subnet ( $172.20.10.0/24$ ). These instances must run SQL queries against an Amazon RDS PostgreSQL database located in a private Data Warehouse Subnet ( $172.20.20.0/24$ ). Additionally, the analytics instances must fetch hourly compliance updates from an external API endpoint over HTTPS (port $443$ ) via a NAT Gateway located in a public subnet ( $172.20.100.0/24$ ). Strict compliance standards require that Network ACLs at the subnet boundaries enforce the principle of least privilege. Assuming the Security Groups are already configured correctly, which combination of Network ACL configurations for the Analytics Engine Subnet ( $172.20.10.0/24$ ) must be implemented to support this traffic? (Select TWO.)

An outbound Network ACL rule allowing TCP traffic to destination $172.20.20.0/24$ on port $5432$ , and an outbound Network ACL rule allowing TCP traffic to destination $0.0.0.0/0$ on port $443$ .Answer
An inbound Network ACL rule allowing TCP traffic from source $172.20.20.0/24$ on source port $5432$ to destination ports $1024-65535$ , and an inbound Network ACL rule allowing TCP traffic from source $0.0.0.0/0$ on source port $443$ to destination ports $1024-65535$ .Answer
C
An inbound Network ACL rule allowing TCP traffic from source $172.20.20.0/24$ on destination port $5432$ , and an inbound Network ACL rule allowing TCP traffic from source $0.0.0.0/0$ on destination port $443$ .
D
No inbound Network ACL rules are required to allow response traffic from the database or the internet, because Network ACLs are stateful and automatically track connection states.
E
An outbound Network ACL rule allowing TCP traffic to destination $172.20.20.0/24$ on ephemeral ports $1024-65535$ , and an outbound Network ACL rule allowing TCP traffic to destination $0.0.0.0/0$ on ephemeral ports $1024-65535$ .

Answer

To support this traffic, the Network ACL for the Analytics Engine Subnet must have outbound rules allowing TCP to the database subnet on port

5432

and to the internet on port

443

. It must also have inbound rules allowing TCP from the database subnet on source port

5432

and the internet on source port

443

to destination ephemeral ports

1024-65535

The correct answer combines the outbound rules that allow the initial requests to reach their targets (destination port

5432

for the database and destination port

443

for the internet) with the inbound rules that allow return traffic. Because Network ACLs are stateless, inbound rules must be created to allow response traffic back into the subnet. Since the database and external API act as servers, their response packets will have source ports

5432

and

443

, respectively, and will target the ephemeral port range (

1024-65535

) on the client instances inside the analytics subnet.

Step-by-Step Solution

Determine the destination ports for outbound requests initiated by the analytics instances.

The analytics instances initiate outbound connections to the database on port

5432

(PostgreSQL) and to the internet on port

443

(HTTPS).

This establishes that the outbound Network ACL rules must target destination ports

5432

and

443

respectively.

Analyze how return traffic behaves across the stateless subnet boundary.

Network ACLs are stateless, meaning return traffic is not automatically tracked or allowed. The response packets coming back from the database have a source port of

5432

, and response packets from the internet have a source port of

443

This dictates that inbound rules must be explicitly created to handle the returning traffic.

Identify the destination ports for the inbound return traffic on the client instances.

The returning packets target the ephemeral port range (

1024-65535

) on the analytics instances.

This means the inbound rules must permit traffic from source ports

5432

and

443

to destination ports

1024-65535

Key Concept

Statelessness of Network ACLs and the necessity of configuring ephemeral port ranges for return traffic.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic