A financial services company hosts a payment processing application on Amazon EC2 instance… — AWS Certified Solutions Architect - Associate

A financial services company hosts a payment processing application on Amazon EC2 instances in a private VPC subnet with the CIDR block $172.16.5.0/24$ . The application must securely communicate with an on-premises hardware security module (HSM) on port $443$ via an AWS Site-to-Site VPN connection (on-premises network CIDR $192.168.10.0/24$ ). Additionally, the application must access the AWS Key Management Service (AWS KMS) via an Interface VPC Endpoint located at $172.16.5.50$ in the same subnet. The company enforces strict regulatory requirements: all external internet access is blocked, and Network ACLs (NACLs) must operate under a default-deny posture. Which of the following configurations are required to establish these network connections while adhering to the principle of least privilege and stateless inspection? (Select TWO).

Configure an outbound Network ACL rule for the EC2 subnet allowing TCP port $443$ to the destination CIDRs ( $192.168.10.0/24$ and $172.16.5.50/32$ ), and a corresponding inbound Network ACL rule allowing TCP ports $1024-65535$ from these destinations.Answer
Configure a Security Group associated with the EC2 instances with outbound rules allowing TCP port $443$ to the on-premises network CIDR ( $192.168.10.0/24$ ) and the Security Group of the KMS interface endpoint, with no inbound rules configured for return traffic.Answer
C
Configure an inbound Network ACL rule for the EC2 subnet allowing TCP port $443$ from the destination CIDRs ( $192.168.10.0/24$ and $172.16.5.50/32$ ), relying on the stateful nature of Network ACLs to allow the outbound return traffic.
D
Configure a Security Group associated with the EC2 instances with an inbound rule allowing TCP ports $1024-65535$ from the KMS interface endpoint and the on-premises network to accept response traffic.
E
Configure an outbound Route Table entry in the EC2 subnet routing traffic destined for the KMS interface endpoint IP ( $172.16.5.50/32$ ) to the Virtual Private Gateway ( $vgw-\text{xxxxxx}$ ) to leverage the VPN connection.

Answer

To establish secure connections under strict stateless controls, configure a Network ACL allowing outbound port 443 traffic to the destinations and inbound ephemeral port traffic (1024-65535) from them, and configure a stateful Security Group with outbound port 443 permissions without any inbound return rules.

Network ACLs are stateless, meaning both request and response paths must be explicitly defined; hence, an outbound rule for port 443 and an inbound rule for ephemeral return ports (1024-65535) are required. Security Groups are stateful, so allowing outbound port 443 to the destinations automatically permits the return response traffic without needing inbound rules.

Step-by-Step Solution

Analyze Network ACL stateless behavior.

Determined that outbound traffic to the destinations requires an explicit rule on port 443, and the return traffic requires an inbound rule on ephemeral ports (1024-65535).

Network ACLs are stateless and do not automatically allow return traffic.

Analyze Security Group stateful behavior.

Determined that allowing outbound port 443 traffic to the destinations automatically permits response traffic, without needing inbound rules.

Security Groups are stateful and automatically track connections to allow return traffic.

Verify VPC routing rules for Interface Endpoints.

Confirmed that local routes in the route table handle Interface Endpoint traffic natively within the VPC.

VPC Interface Endpoints are hosted inside the VPC and do not rely on Virtual Private Gateways for routing.

Key Concept

VPC Network Security and Statefulness Comparison (Security Groups vs Network ACLs)

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic