Examkin

Question

Difficulty: HardVPC Network Security

A company runs a data processing application on Amazon EC2 instances in a private subnet (CIDR 10.0.2.0/2410.0.2.0/24) of a VPC. The application needs to download datasets from an Amazon S3 bucket in the same AWS Region using an S3 Gateway Endpoint. Additionally, the application must upload logs to an external partner's HTTPS service hosted at the static IP address 198.51.100.50198.51.100.50. The EC2 instances initiate all connections using ephemeral ports (1024−655351024-65535).

A solutions architect must configure the VPC security groups and Network Access Control Lists (NACLs) to enforce the principle of least privilege.

Which combination of actions will allow the required traffic while restricting all other access? (Select TWO.)

  1. Configure the security group attached to the EC2 instances with outbound rules that allow TCP traffic on port 443 to the Amazon S3 prefix list and to 198.51.100.50/32198.51.100.50/32.Answer
  2. B
    Configure the security group attached to the EC2 instances with outbound rules allowing TCP traffic on port 443 to the Amazon S3 prefix list and 198.51.100.50/32198.51.100.50/32, and inbound rules allowing TCP traffic on ports 1024−655351024-65535 from both destinations.
  3. Configure the subnet NACL with outbound rules allowing TCP traffic on port 443 to 198.51.100.50/32198.51.100.50/32 and 0.0.0.0/00.0.0.0/0, and inbound rules allowing TCP traffic on ports 1024−655351024-65535 from 198.51.100.50/32198.51.100.50/32 and 0.0.0.0/00.0.0.0/0.Answer
  4. D
    Configure the subnet NACL with outbound rules allowing TCP traffic on port 443 to 198.51.100.50/32198.51.100.50/32 and the Amazon S3 prefix list, and inbound rules allowing TCP traffic on ports 1024−655351024-65535 from both destinations.
  5. E
    Configure the private subnet's route table with a default route (0.0.0.0/00.0.0.0/0) pointing to the S3 Gateway Endpoint to route both S3 and external HTTPS traffic.

Answer

Configure the security group with outbound rules allowing TCP traffic on port 443 to the S3 prefix list and the partner's IP, and configure the subnet NACL with outbound rules to those destinations on port 443 and inbound rules allowing return traffic on ephemeral ports (using 0.0.0.0/00.0.0.0/0 for S3 since NACLs do not support prefix lists).
The correct combination requires understanding stateful vs. stateless traffic filtering and the platform limitations of NACLs and Security Groups. First, the option configuring the security group with outbound rules to the S3 prefix list and the partner's IP on port 443 is correct because security groups are stateful and automatically allow return traffic on ephemeral ports. Second, the option configuring the subnet NACL with outbound rules on port 443 to the partner IP and 0.0.0.0/00.0.0.0/0, along with inbound rules on ephemeral ports, is correct because NACLs are stateless and do not support VPC prefix lists.

Step-by-Step Solution

1
Analyze security group requirements for stateful evaluation.
Since security groups are stateful, only outbound rules to the target destinations (the S3 prefix list and the partner IP address) on port 443 are needed. Inbound rules for ephemeral return ports are not required.
This establishes least-privilege egress access at the instance level.
2
Determine NACL capabilities and rule requirements.
NACLs are stateless and evaluate traffic in both directions. Inbound rules must be created to allow return traffic on ephemeral ports (1024−655351024-65535). Additionally, NACLs do not support referencing VPC prefix lists, so a CIDR block of 0.0.0.0/00.0.0.0/0 must be used to cover Amazon S3 IP addresses.
This ensures the stateless subnet boundary allows the return traffic for initiated connections.
3
Verify route table configuration constraints.
Gateway Endpoints modify route tables with specific prefix list routes but cannot be used as a target for a default route (0.0.0.0/00.0.0.0/0) to route external API traffic.
This confirms that route tables must be configured with a NAT Gateway or similar virtual private gateway route for the partner API.

Key Concept

Stateful vs. Stateless network filtering and resource limitations within VPC security structures.
Estimated Time:2m 0s
Rate this question

Topics

VPC Network Security

More questions from this topic