A company is deploying a secure microservices application on Amazon EC2 instances within a… — AWS Certified Solutions Architect - Associate

A company is deploying a secure microservices application on Amazon EC2 instances within a private subnet ( $10.0.2.0/24$ ) of an Amazon VPC. The application must receive HTTPS requests on TCP port $8443$ from an internal Application Load Balancer (ALB) located in a separate private subnet ( $10.0.1.0/24$ ). Additionally, the EC2 instances must download container assets from Amazon S3 and write application logs to an S3 bucket. A Gateway VPC Endpoint is configured for S3 (`vpce-s3`) in the VPC. The company's security policy requires the use of strict, custom Network ACLs (NACLs) on the application subnet that operate under a default-deny posture, allowing only the minimum required traffic. Security Groups are also configured at the instance level.

Which of the following configurations must a solutions architect implement to establish secure, functional network connectivity for the application? (Select TWO.)

An inbound rule in the application subnet NACL allowing TCP traffic from $10.0.1.0/24$ on port $8443$ , and an outbound rule in the same NACL allowing TCP traffic to $10.0.1.0/24$ on ports $1024-65535$ .Answer
An outbound rule in the application subnet NACL allowing TCP traffic to the Amazon S3 prefix list on port $443$ , and an inbound rule in the same NACL allowing TCP traffic from the Amazon S3 prefix list on ports $1024-65535$ .Answer
C
An outbound rule in the application Security Group allowing TCP traffic to the Amazon S3 prefix list on port $443$ , and an inbound rule in the same Security Group allowing TCP traffic from the Amazon S3 prefix list on ports $1024-65535$ .
D
An inbound rule in the application subnet NACL allowing TCP traffic from $10.0.1.0/24$ on port $8443$ , relying on the NACL's stateful tracking to automatically allow outbound return traffic to the ALB.
E
An outbound rule in the application subnet NACL allowing TCP traffic to the Amazon S3 prefix list on port $443$ , while routing S3 traffic through a NAT Gateway deployed in the application subnet to bypass inbound NACL requirements.

Answer

Implementing an inbound rule in the application subnet NACL for port 8443 along with an outbound rule for the ephemeral port range 1024-65535 to the ALB subnet, and implementing an outbound rule in the application subnet NACL to the S3 prefix list on port 443 along with an inbound rule for the ephemeral port range 1024-65535 from the S3 prefix list.

The correct configurations involve setting up both inbound and outbound rules for the stateless Network ACL (NACL) to permit connection initiation and return traffic. For traffic initiated by the ALB, the NACL requires an inbound rule for the HTTPS traffic on port 8443 and an outbound rule to allow the response to reach the ALB's ephemeral port range (1024-65535). For traffic initiated by the EC2 instances to Amazon S3, the NACL requires an outbound rule to the S3 prefix list on port 443 and an inbound rule to allow S3's response to reach the EC2 instances' ephemeral port range.

Step-by-Step Solution

Analyze the statefulness of the VPC security layers.

Identify that Security Groups are stateful (automatically permit return traffic) and Network ACLs (NACLs) are stateless (must explicitly define rules for both inbound and outbound traffic directions).

This establishes the fundamental behavior required to define correct NACL rules without making stateful assumptions.

Evaluate the traffic flow from the ALB to the EC2 instances.

The connection is initiated by the ALB from subnet 10.0.1.0/24 on port 8443 to the EC2 instances in subnet 10.0.2.0/24. The return traffic goes from the EC2 instances back to the ALB's ephemeral port range (1024-65535).

This details the exact inbound port and outbound ephemeral port range needed in the stateless NACL for the ALB-to-EC2 path.

Evaluate the traffic flow from the EC2 instances to Amazon S3.

The connection is initiated by the EC2 instances in subnet 10.0.2.0/24 to S3 via the Gateway VPC Endpoint on port 443 (HTTPS). The return traffic goes from S3 (public IP addresses matched by the S3 prefix list) back to the EC2 instances' ephemeral ports (1024-65535).

This details the outbound port and inbound ephemeral port range needed in the stateless NACL for the EC2-to-S3 path.

Synthesize the rules and rule out incorrect options.

Confirm that the NACL must have the ALB inbound/outbound rules and the S3 outbound/inbound rules. Rule out options that rely on NACL statefulness, misapply Security Group rule requirements, or suggest incorrect NAT Gateway configurations.

Ensures that all distractors are successfully eliminated based on cloud architecture rules.

Key Concept

VPC Network Security

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic