A company is setting up a secure multi-tier application in a VPC. The database tier runs o… — AWS Certified Solutions Architect - Associate

A company is setting up a secure multi-tier application in a VPC. The database tier runs on Amazon EC2 instances located in a private subnet ( $10.0.2.0/24$ ). The database instances need to periodically initiate outbound connections to download software patches from an external repository on the public internet over HTTPS (TCP port $443$ ). A NAT Gateway is deployed in the public subnet ( $10.0.1.0/24$ ) to facilitate egress, and the private subnet's route table contains a default route ( $0.0.0.0/0$ ) pointing to the NAT Gateway. The database subnet uses a custom Network Access Control List (NACL) that currently denies all traffic. The database instances are associated with a custom security group. Which configuration of security group and NACL rules must the solutions architect implement to allow the database instances to download patches while maintaining the principle of least privilege?

Security Group: Outbound rule allowing TCP port $443$ to $0.0.0.0/0$ . No inbound rules. Subnet NACL: Outbound rule allowing TCP port $443$ to $0.0.0.0/0$ ; Inbound rule allowing TCP ports $1024-65535$ from $0.0.0.0/0$ .Answer
B
Security Group: Outbound rule allowing TCP port $443$ to $0.0.0.0/0$ . Inbound rule allowing TCP ports $1024-65535$ from $0.0.0.0/0$ . Subnet NACL: Outbound rule allowing TCP port $443$ to $0.0.0.0/0$ . No inbound rules.
C
Security Group: Outbound rule allowing TCP port $443$ to the NAT Gateway's private IP address. No inbound rules. Subnet NACL: Outbound rule allowing TCP port $443$ to the NAT Gateway's private IP address; Inbound rule allowing TCP ports $1024-65535$ from the NAT Gateway's private IP address.
D
Security Group: Outbound rule allowing TCP port $443$ to $0.0.0.0/0$ . No inbound rules. Subnet NACL: Outbound rule allowing TCP port $443$ to $0.0.0.0/0$ ; Inbound rule allowing TCP port $443$ from $0.0.0.0/0$ .

Answer

Security Group: Outbound rule allowing TCP port

443

0.0.0.0/0

. No inbound rules. Subnet NACL: Outbound rule allowing TCP port

443

0.0.0.0/0

; Inbound rule allowing TCP ports

1024-65535

from

0.0.0.0/0

The correct configuration uses the stateful nature of Security Groups and the stateless nature of NACLs. For the Security Group, an outbound rule for TCP port

443

allows the connection to be established, and the stateful tracking automatically allows the return traffic back in. For the NACL, an outbound rule allows the outbound request on TCP port

443

, and an inbound rule allows return traffic to enter the subnet on the ephemeral ports (

1024-65535

) used by the initiating client instances.

Step-by-Step Solution

Analyze the statefulness of the Security Group.

Since Security Groups are stateful, any outbound request allowed on TCP port

443

automatically permits the return response to enter. No inbound rules are required.

To maintain the principle of least privilege, we should only define the outbound rule.

Analyze the statelessness of the Network ACL (NACL) outbound flow.

NACLs are stateless, meaning return traffic is not tracked. An outbound rule allowing TCP port

443

0.0.0.0/0

is required for the outbound patch request to leave the subnet.

The packet destination IP is the external repository, so the rule must target

0.0.0.0/0

rather than the NAT Gateway's IP.

Analyze the statelessness of the NACL inbound flow.

Because the client establishes a connection using an ephemeral source port, the return traffic from the repository will target that ephemeral port range (

1024-65535

). An inbound rule allowing TCP ports

1024-65535

from

0.0.0.0/0

is required.

Without this inbound rule, the stateless NACL will drop the returning packets from the repository.

Key Concept

Understanding the functional differences between stateful Security Groups (operating at the instance level) and stateless Network ACLs (operating at the subnet level), including ephemeral port requirements and destination IP evaluation.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic