Examkin

Question

Difficulty: MediumVPC Network Security

A logistics company is deploying a two-tier application in a new VPC. The web tier consists of Amazon EC2 instances in a public subnet (10.0.1.0/2410.0.1.0/24) behind an Application Load Balancer. The database tier consists of Amazon RDS MySQL instances in a private subnet (10.0.2.0/2410.0.2.0/24). The security team requires that the database subnet be isolated such that it only receives database connections from the web tier. Additionally, they must ensure the return traffic from the database can reach the web tier, while preventing any other egress traffic.

Which combination of Security Group and Network Access Control List (NACL) configurations meets these security requirements?

  1. A
    Associate a security group with the database instances that allows inbound TCP port 33063306 traffic from the public subnet CIDR block (10.0.1.0/2410.0.1.0/24). Configure the database subnet Network ACL (NACL) to allow inbound TCP port 33063306 traffic from the web servers' security group, and allow outbound TCP traffic on ephemeral ports 1024−655351024-65535 to the public subnet CIDR block (10.0.1.0/2410.0.1.0/24).
  2. B
    Associate a security group with the database instances that allows inbound TCP port 33063306 traffic from the web servers' security group. Configure the database subnet Network ACL (NACL) to allow inbound TCP port 33063306 traffic from the public subnet CIDR block (10.0.1.0/2410.0.1.0/24), and set the outbound Network ACL rules to deny all outbound traffic to prevent unauthorized database egress.
  3. Associate a security group with the database instances that allows inbound TCP port 33063306 traffic from the web servers' security group. Configure the database subnet Network ACL (NACL) to allow inbound TCP port 33063306 traffic from the public subnet CIDR block (10.0.1.0/2410.0.1.0/24), and allow outbound TCP traffic on ephemeral ports 1024−655351024-65535 to the public subnet CIDR block (10.0.1.0/2410.0.1.0/24).Answer
  4. D
    Associate a security group with the database instances that allows inbound TCP port 33063306 traffic from the web servers' security group, and outbound TCP traffic on ephemeral ports 1024−655351024-65535 to the web servers' security group. Configure the database subnet Network ACL (NACL) to allow inbound TCP port 33063306 traffic from the public subnet CIDR block (10.0.1.0/2410.0.1.0/24), but configure no outbound rules in the Network ACL.

Answer

Associate a security group with the database instances that allows inbound TCP port 3306 traffic from the web servers' security group. Configure the database subnet Network ACL (NACL) to allow inbound TCP port 3306 traffic from the public subnet CIDR block (10.0.1.0/24), and allow outbound TCP traffic on ephemeral ports 1024-65535 to the public subnet CIDR block (10.0.1.0/24).
The correct answer provides the necessary stateful and stateless configurations to achieve isolation. The Security Group configuration references the web servers' security group for strict instance-to-instance access, which automatically allows stateful outbound responses. The Network ACL configuration defines stateless inbound rules for port 33063306 and stateless outbound rules for the ephemeral ports (1024−655351024-65535) back to the public subnet, ensuring response packets are not dropped at the subnet boundary.

Step-by-Step Solution

1
Configure the database security group rule.
Create an inbound rule allowing TCP port 33063306 from the source Web Security Group.
Security groups are stateful and allow least-privilege tracking of individual EC2 instances rather than hardcoded CIDRs.
2
Configure the database subnet inbound Network ACL rule.
Create an inbound rule allowing TCP port 33063306 from the public subnet CIDR block (10.0.1.0/2410.0.1.0/24).
Network ACLs operate at the subnet boundary and filter traffic using CIDR blocks. This allows incoming database requests from the web tier.
3
Configure the database subnet outbound Network ACL rule.
Create an outbound rule allowing TCP ports 1024−655351024-65535 to the public subnet CIDR block (10.0.1.0/2410.0.1.0/24).
Since Network ACLs are stateless, return traffic must be explicitly allowed. MySQL client requests originating from the web servers use ephemeral ports (1024−655351024-65535) to receive the database response.

Key Concept

Stateful vs. Stateless Filtering in VPC Security
Rate this question

Topics

VPC Network Security

More questions from this topic