A company runs a critical data ingestion service on Amazon EC2 instances in a private subn… — AWS Certified Solutions Architect - Associate

A company runs a critical data ingestion service on Amazon EC2 instances in a private subnet ( $172.31.20.0/24$ ). The instances must download software updates from a specific external HTTPS endpoint at $198.51.100.45/32$ . The VPC routes internet-bound traffic from the private subnet through a NAT Gateway located in a public subnet. The company requires strict restriction of traffic at the private subnet boundary. A solutions architect is configuring the Network ACL (NACL) associated with the private subnet. Which configuration will allow the EC2 instances to successfully download the updates while maintaining the most secure posture?

Configure an outbound NACL rule allowing TCP traffic to destination $198.51.100.45/32$ on port $443$ , and an inbound NACL rule allowing TCP traffic from source $198.51.100.45/32$ on ports $1024$ - $65535$ .Answer
B
Configure an outbound NACL rule allowing TCP traffic to destination $198.51.100.45/32$ on port $443$ . No inbound rule is required because Network ACLs automatically track connections and allow return traffic.
C
Configure an outbound NACL rule allowing TCP traffic to destination $198.51.100.45/32$ on ports $1024$ - $65535$ , and an inbound NACL rule allowing TCP traffic from source $198.51.100.45/32$ on port $443$ .
D
Configure an outbound NACL rule allowing TCP traffic to the private IP address of the NAT Gateway on port $443$ , and an inbound NACL rule allowing TCP traffic from the private IP address of the NAT Gateway on ports $1024$ - $65535$ .

Answer

Configure an outbound NACL rule allowing TCP traffic to destination

198.51.100.45/32

on port

443

, and an inbound NACL rule allowing TCP traffic from source

198.51.100.45/32

on ports

1024

65535

The correct configuration consists of an outbound NACL rule to TCP port 443 with the destination of the external server's IP address, and an inbound NACL rule from the external server's IP address targeting the ephemeral port range (1024-65535). Because Network ACLs (NACLs) are stateless, they do not track connection state, meaning separate rules must allow both the initial outgoing request and the incoming response. Additionally, since the NACL is evaluated at the private subnet boundary before the traffic reaches the NAT Gateway in the public subnet, the destination IP on the outbound rule must be the external server's public IP.

Step-by-Step Solution

Analyze the direction and ports of the initial connection.

The connection is initiated by the EC2 instances in the private subnet targeting the external server's HTTPS port. The outbound packet has a destination IP of

198.51.100.45

and destination port

443

(HTTPS). The source port is a randomly allocated ephemeral port (typically

1024

65535

To allow the initial handshake to go out, the private subnet's NACL must permit outbound TCP traffic to the target IP on port 443.

Analyze the return traffic flow and evaluate NACL statelessness.

The external server responds by sending packets back. The inbound packet has a source IP of

198.51.100.45

, source port

443

, and a destination port in the ephemeral range (

1024

65535

). Since Network ACLs are stateless, they do not track connection state and require a rule to allow this inbound return traffic.

To prevent the return packets from being dropped at the private subnet boundary, an inbound rule permitting traffic from the target IP on ephemeral ports must be added.

Determine the impact of NAT Gateway routing on IP headers at the subnet boundary.

Although the traffic is routed through a NAT Gateway, the translation of the source IP address occurs at the NAT Gateway within the public subnet. At the private subnet boundary where the private subnet's NACL is evaluated, the destination IP on outbound packets remains the public IP of the external server (

198.51.100.45/32

The NACL rules must reference the external destination IP rather than the NAT Gateway's IP address.

Key Concept

Network ACLs (NACLs) act as stateless firewalls at the subnet level. Because they are stateless, any allowed outbound traffic must have a corresponding inbound rule to permit the return traffic, which typically targets the client's ephemeral port range (TCP 1024-65535). Furthermore, NACL rules are evaluated before NAT processing occurs, so they must target the final destination IP address.

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic