A financial technology company runs a payment validation service on Amazon EC2 instances w… — AWS Certified Solutions Architect - Associate

A financial technology company runs a payment validation service on Amazon EC2 instances within a private subnet. The instances must make outbound HTTPS requests to an external credit bureau API on port $443$ to verify transaction details. The security group associated with the EC2 instances allows outbound traffic to $0.0.0.0/0$ on port $443$ and has no inbound rules. To comply with security audits, the solutions architect must configure the private subnet's Network Access Control List (Network ACL) with the most restrictive rules possible to support this traffic. Which Network ACL configuration should the solutions architect apply to the private subnet to allow the validation traffic to flow successfully?

Outbound rule: Allow TCP port $443$ to $0.0.0.0/0$ . Inbound rule: Allow TCP ports $1024 - 65535$ from $0.0.0.0/0$ .Answer
B
Outbound rule: Allow TCP port $443$ to $0.0.0.0/0$ . Inbound rule: No inbound rules are required because the Network ACL automatically tracks return traffic.
C
Outbound rule: Allow TCP port $443$ to $0.0.0.0/0$ . Inbound rule: Allow TCP port $443$ from $0.0.0.0/0$ .
D
Outbound rule: Allow TCP ports $1024 - 65535$ to $0.0.0.0/0$ . Inbound rule: Allow TCP port $443$ from $0.0.0.0/0$ .

Answer

Configure an outbound Network ACL rule allowing TCP port 443 to anywhere, and an inbound Network ACL rule allowing TCP ports 1024 to 65535 from anywhere.

The correct configuration requires allowing outbound traffic to port 443 because the EC2 instances are initiating HTTPS requests to the external API. Because Network ACLs are stateless, they do not track connection state; therefore, a separate inbound rule must be configured to allow the return traffic. The return traffic is sent from the external API back to the ephemeral ports (TCP 1024 - 65535) allocated by the EC2 client instances.

Step-by-Step Solution

Analyze the stateful nature of Security Groups.

The security group is stateful, so allowing outbound port 443 traffic automatically permits the corresponding inbound response traffic at the instance level.

Security groups track connections and permit response traffic regardless of inbound rules.

Analyze the stateless nature of Network ACLs (NACLs).

NACLs operate at the subnet boundary and are stateless. Outbound requests and inbound responses must be explicitly allowed.

Unlike security groups, NACLs do not track connection state and evaluate every packet independently.

Identify the ports utilized by the outbound request and its response.

The outbound request goes to destination port 443 (HTTPS). The returning traffic from the external server is sent to the ephemeral source ports (typically 1024 - 65535) allocated by the client EC2 instances.

Client OS TCP/IP stacks allocate ephemeral ports for outbound connections to receive returning responses.

Synthesize the correct NACL rules.

An outbound rule allowing destination port 443 to anywhere, and an inbound rule allowing destination ephemeral ports (1024 - 65535) from anywhere.

This matches the traffic direction and port requirements for both components of the TCP handshake and data transfer.

Key Concept

Stateless Network ACLs require explicit inbound rules for response traffic on ephemeral ports.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic