Examkin

Question

Difficulty: MediumVPC Network Security

A company is deploying a secure database tier on Amazon EC2 instances in a private subnet (Subnet B: 10.0.2.0/2410.0.2.0/24) of a VPC. The database instances run PostgreSQL. The application tier runs on EC2 instances in a different private subnet (Subnet A: 10.0.1.0/2410.0.1.0/24). The database instances must only allow inbound database traffic from the application instances. The database instances must be blocked from initiating any outbound connections to the internet, but they must be able to securely connect to AWS Systems Manager (SSM) via interface VPC endpoints to download software updates.

Which TWO configurations must a solutions architect implement to meet these requirements with least privilege? (Select TWO.)

  1. Configure the database security group to allow inbound TCP port 5432 from the application security group, and outbound TCP port 443 to the SSM VPC endpoint security group, removing the default outbound rule that allows all traffic.Answer
  2. Configure the VPC endpoint security group to allow inbound TCP port 443 from the database security group.Answer
  3. C
    Associate the database security group with Subnet B to enforce traffic filtering at the subnet boundary, ensuring no outbound traffic is allowed to route to the internet.
  4. D
    Configure the Network ACL for Subnet B to allow inbound TCP port 5432 from Subnet A, relying on the stateful nature of Network ACLs to automatically permit return traffic to the application tier.
  5. E
    Configure the database security group to allow outbound TCP port 443 to 0.0.0.0/00.0.0.0/0 so that the patch requests can be inspected by AWS WAF before being routed to AWS Systems Manager.

Answer

To meet the requirements, the database security group must be configured to allow inbound TCP port 5432 from the application security group and outbound TCP port 443 to the SSM VPC endpoint security group (with the default outbound rule removed). Additionally, the VPC endpoint security group must allow inbound TCP port 443 from the database security group.
The database security group must allow inbound database traffic on port 5432 from the application security group and outbound HTTPS traffic on port 443 to the security group of the SSM VPC endpoint, with the default outbound rule removed to prevent any other outbound traffic. The VPC endpoint security group must allow inbound HTTPS traffic on port 443 from the database security group. Since security groups are stateful, return traffic for both connections is automatically permitted.

Step-by-Step Solution

1
Analyze the communication flow and stateful nature of security groups.
Database instances must receive inbound connections from application instances on port 5432. Since security groups are stateful, allowing inbound port 5432 from the application security group automatically allows the return database traffic. To block database instances from initiating general internet traffic while allowing them to connect to Systems Manager, we must remove the default 'allow all outbound' rule and add a specific outbound rule for TCP port 443 pointing to the target SSM VPC endpoint.
This implements the principle of least privilege at the instance level.
2
Configure the interface VPC endpoint security group.
Interface endpoints use Elastic Network Interfaces (ENIs) which are protected by security groups. To allow the database instances to successfully connect, the endpoint's security group must permit inbound HTTPS (TCP 443) traffic from the database security group.
VPC interface endpoints require explicit inbound security group rules to accept incoming traffic from VPC clients.
3
Evaluate subnet-level versus instance-level security controls.
Confirm that Network ACLs are stateless and apply at the subnet level, meaning they would require both inbound and outbound rules, whereas security groups are stateful and apply to network interfaces. This rules out options that confuse Network ACL statelessness or associate security groups directly with subnets.
Avoiding common configuration errors ensures a secure and functional network architecture.

Key Concept

VPC Network Security using stateful Security Groups and Interface VPC Endpoints
Estimated Time:2m 0s
Rate this question

Topics

VPC Network Security

More questions from this topic