Examkin

Question

Difficulty: MediumVPC Network Security

A company has a three-tier web application hosted in a VPC. The database tier resides in a private subnet and needs to retrieve software patches from an external repository on the internet, while blocking all other outbound and inbound traffic. A NAT gateway has been deployed in a public subnet to facilitate outbound internet access. Which configurations should a solutions architect implement to secure this network path while ensuring successful patch downloads? (Select TWO.)

  1. Configure the database instances' security group to allow outbound HTTP and HTTPS traffic to the destination IP range of the external repository.Answer
  2. Configure the network ACL of the database subnet to allow outbound HTTP and HTTPS traffic to the public subnet, and allow inbound traffic on ephemeral ports (1024-65535) from the public subnet.Answer
  3. C
    Configure the network ACL of the database subnet to allow outbound HTTP and HTTPS traffic to the public subnet, relying on the stateful nature of network ACLs to permit the return traffic.
  4. D
    Associate a security group directly with the NAT gateway to allow inbound traffic from the database subnet on ports 80 and 443.
  5. E
    Configure the database instances' security group to allow inbound traffic from the external repository on ephemeral ports (1024-65535) to receive the patch responses.

Answer

Configure the database instances' security group to allow outbound HTTP/HTTPS traffic to the destination IP range, and configure the database subnet's network ACL to allow outbound HTTP/HTTPS traffic to the public subnet while allowing inbound traffic on ephemeral ports (1024-65535) from the public subnet.
The correct configurations are to configure the database instances' security group to allow outbound HTTP/HTTPS traffic, and configure the database subnet's network ACL to allow outbound HTTP/HTTPS traffic as well as inbound ephemeral port traffic. Because security groups are stateful, they automatically track connections and allow return traffic without an explicit inbound rule. Because network ACLs are stateless, they require explicit rules for both outbound request traffic and inbound response traffic.

Step-by-Step Solution

1
Evaluate security group statefulness.
The security group associated with the database EC2 instances must permit outbound HTTP/HTTPS traffic. Since security groups are stateful, return traffic on ephemeral ports is automatically allowed without requiring an inbound rule.
To allow the outbound connection initiation from the database to the external repository.
2
Evaluate network ACL statelessness.
The network ACL associated with the database subnet must allow outbound HTTP/HTTPS traffic to the public subnet. Because network ACLs are stateless, a corresponding inbound rule must also be configured to allow return traffic on ephemeral ports (1024-65535) from the public subnet.
To permit both the outgoing request and the incoming response across the stateless subnet boundary.
3
Eliminate incorrect options based on service limitations and firewall state characteristics.
NAT gateways do not support security groups. Outbound security group rules do not require matching inbound ephemeral rules due to statefulness. Network ACLs do not track state, so outbound-only rules will block return traffic.
To rule out invalid configurations that violate AWS platform features or firewall behaviors.

Key Concept

VPC Network Security
Rate this question

Topics

VPC Network Security

More questions from this topic