Examkin

Question

Difficulty: HardVPC Network Security

A company is deploying a secure containerized application on Amazon EC2 instances within a private subnet (Subnet A: 10.10.1.0/2410.10.1.0/24). The application must consume a third-party messaging service hosted in an on-premises data center via an established AWS Direct Connect connection. The on-premises messaging service endpoint is at 192.168.10.50192.168.10.50 and listens on TCP port 56725672. The security team has implemented a custom Network Access Control List (NACL) for Subnet A. The Security Group (SG) associated with the EC2 instances allows outbound TCP traffic on port 56725672 to 192.168.10.50/32192.168.10.50/32 and has no inbound rules. Which configuration of NACL rules for Subnet A is required to establish successful outbound communication to the on-premises service while maintaining the principle of least privilege?

  1. A
    Inbound: No inbound rules are required because the Security Group is stateful. Outbound: Allow TCP traffic on port 56725672 to destination 192.168.10.50/32192.168.10.50/32.
  2. Inbound: Allow TCP traffic on ports 10241024-6553565535 from source 192.168.10.50/32192.168.10.50/32. Outbound: Allow TCP traffic on port 56725672 to destination 192.168.10.50/32192.168.10.50/32.Answer
  3. C
    Inbound: Allow TCP traffic on port 56725672 from source 192.168.10.50/32192.168.10.50/32. Outbound: Allow TCP traffic on port 56725672 to destination 192.168.10.50/32192.168.10.50/32.
  4. D
    Inbound: Allow all traffic from source 0.0.0.0/00.0.0.0/0. Outbound: Allow all traffic to destination 0.0.0.0/00.0.0.0/0.

Answer

Inbound: Allow TCP traffic on ports 10241024-6553565535 from source 192.168.10.50/32192.168.10.50/32. Outbound: Allow TCP traffic on port 56725672 to destination 192.168.10.50/32192.168.10.50/32.
The correct option is the one that configures the outbound NACL rule to allow TCP port 56725672 to the on-premises IP address, and configures the inbound NACL rule to allow the return traffic on the ephemeral port range (10241024-6553565535) from the same IP address. Because Network ACLs are stateless, return traffic is not automatically permitted and must be explicitly allowed by matching the client's dynamic source ports.

Step-by-Step Solution

1
Analyze the connection flow direction.
The EC2 instances in Subnet A initiate outbound TCP connections to the on-premises endpoint (192.168.10.50192.168.10.50) on service port 56725672.
This establishes that the outbound destination port is 56725672 and the destination IP is 192.168.10.50/32192.168.10.50/32.
2
Determine the statefulness of the VPC security layers.
Security Groups are stateful (allowing return traffic automatically), but Network ACLs are stateless (requiring explicit rules for both request and response traffic).
Both inbound and outbound rules must be explicitly configured in the NACL for Subnet A to allow the traffic flow.
3
Identify the ports used for request and return traffic.
Outbound requests target destination port 56725672 from client ephemeral ports (10241024-6553565535). Returning traffic targets client ephemeral ports (10241024-6553565535) from source port 56725672.
Knowing the correct ports ensures least privilege configuration without blocking the network response.
4
Formulate the minimal NACL rules.
Allow outbound TCP on port 56725672 to 192.168.10.50/32192.168.10.50/32, and allow inbound TCP on ports 10241024-6553565535 from 192.168.10.50/32192.168.10.50/32.
This configuration permits the initiating request and the corresponding stateless response under the principle of least privilege.

Key Concept

VPC Network ACLs are stateless and require explicit rules for both outbound request traffic and inbound ephemeral return traffic.
Estimated Time:2m 0s
Rate this question

Topics

VPC Network Security

More questions from this topic