A data processing application is deployed on Amazon EC2 instances in a private subnet (Sub… — AWS Certified Solutions Architect - Associate

A data processing application is deployed on Amazon EC2 instances in a private subnet (Subnet A: $10.0.2.0/24$ ). The application must initiate outbound database queries to an Amazon RDS PostgreSQL DB instance in another private subnet (Subnet B: $10.0.3.0/24$ ) on port $5432$ . The application must also download external software updates over HTTPS (port $443$ ) through a NAT Gateway located in a public subnet (Subnet C: $10.0.1.0/24$ ). Custom Network Access Control Lists (NACLs) are used to secure the subnets. Which configuration of NACL rules for Subnet A will allow the required traffic while following the principle of least privilege?

A
Inbound: Allow traffic from Source $10.0.3.0/24$ on Port $5432$ and from Source $0.0.0.0/0$ on Port $443$ . Outbound: Allow traffic to Destination $10.0.3.0/24$ on Port $5432$ and to Destination $0.0.0.0/0$ on Port $443$ .
Inbound: Allow traffic from Source $0.0.0.0/0$ on Port Range $1024-65535$ . Outbound: Allow traffic to Destination $10.0.3.0/24$ on Port $5432$ and to Destination $0.0.0.0/0$ on Port $443$ .Answer
C
Inbound: No inbound rules are required because Security Groups are stateful and will automatically allow return traffic. Outbound: Allow traffic to Destination $10.0.3.0/24$ on Port $5432$ and to Destination $0.0.0.0/0$ on Port $443$ .
D
Inbound: No inbound rules are required. Outbound: Allow traffic to Destination $10.0.3.0/24$ on Port $5432$ , and configure AWS WAF at the boundary of Subnet A to inspect and allow outbound HTTPS traffic and its associated return traffic.

Answer

Inbound: Allow traffic from Source

0.0.0.0/0

on Port Range

1024-65535

. Outbound: Allow traffic to Destination

10.0.3.0/24

on Port

5432

and to Destination

0.0.0.0/0

on Port

443

Network Access Control Lists (NACLs) are stateless network filters applied at the subnet boundary. Because they are stateless, both outbound request traffic and inbound response traffic must be explicitly permitted. When the EC2 instances in Subnet A initiate outbound connections to the database (port

5432

) and the external update repository (port

443

), they select a random source port from the ephemeral port range (

1024-65535

). The returning packets from these services will target these ephemeral ports on the EC2 instances. Therefore, the inbound NACL rules must allow return traffic from any source (

0.0.0.0/0

) targeting the ephemeral port range (

1024-65535

Step-by-Step Solution

Analyze the traffic requirements and directions for the EC2 instances in Subnet A.

Outbound traffic consists of database queries to Subnet B (

10.0.3.0/24

) on port

5432

and HTTPS requests to the internet (via NAT Gateway) on port

443

Understanding the traffic destination and ports determines the outbound NACL rules.

Determine how the stateless nature of NACLs impacts return traffic.

Return traffic from both the database and the internet will target the ephemeral port range (

1024-65535

) on the EC2 instances in Subnet A.

NACLs are stateless, so return traffic must be explicitly allowed by inbound rules.

Select the minimum required NACL rules to allow both outbound and inbound traffic.

Outbound rules must permit port

5432

10.0.3.0/24

and port

443

0.0.0.0/0

. Inbound rules must permit port range

1024-65535

from

0.0.0.0/0

This configuration allows initiating requests and receiving responses while keeping other ports blocked.

Key Concept

Stateless behavior of Network Access Control Lists (NACLs) and ephemeral port configurations

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic