Examkin

Question

Difficulty: HardVPC Network Security

A company is deploying an application on Amazon EC2 instances in a private subnet (CIDR: 10.10.2.0/2410.10.2.0/24) of a VPC. The application must securely query a PostgreSQL database (TCPTCP port 54325432) hosted by a partner vendor. The partner has exposed their database service using an AWS PrivateLink VPC endpoint service. A solutions architect creates an Interface VPC endpoint in the private subnet to connect to the partner service. Which configuration of security groups will allow the application to query the database while maintaining the principle of least privilege?

  1. A
    Associate a security group with the EC2 instances that allows outbound TCP traffic on port 54325432 to the CIDR of the private subnet. Associate a security group with the Interface VPC endpoint that allows inbound TCP traffic on port 54325432 from 0.0.0.0/00.0.0.0/0.
  2. B
    Associate a security group with the EC2 instances that allows outbound TCP traffic on port 54325432 to the security group of the Interface VPC endpoint, and inbound TCP traffic on port 54325432 from the Interface VPC endpoint. Associate a security group with the Interface VPC endpoint that allows inbound and outbound TCP traffic on port 54325432.
  3. Associate a security group with the EC2 instances that allows outbound TCP traffic on port 54325432 to the security group of the Interface VPC endpoint. Associate a security group with the Interface VPC endpoint that allows inbound TCP traffic on port 54325432 from the security group of the EC2 instances.Answer
  4. D
    Configure the Network ACL of the private subnet to allow outbound TCP traffic on port 54325432 to the VPC endpoint and inbound TCP traffic on port 54325432 from the VPC endpoint. Do not associate security groups with either the EC2 instances or the Interface VPC endpoint.

Answer

Associate a security group with the EC2 instances that allows outbound TCP traffic on port 54325432 to the security group of the Interface VPC endpoint. Associate a security group with the Interface VPC endpoint that allows inbound TCP traffic on port 54325432 from the security group of the EC2 instances.
The correct option establishes the most secure, least-privilege connection by allowing outbound traffic from the EC2 instances specifically to the VPC endpoint's security group, and inbound traffic to the VPC endpoint specifically from the EC2 instances' security group. Because security groups are stateful, the return traffic does not require additional rules.

Step-by-Step Solution

1
Analyze the traffic initiation path and destination port.
The EC2 instances initiate a TCP connection on port 54325432 to the Interface VPC endpoint.
To allow the initial connection, the security group of the EC2 instances must have an outbound rule allowing TCP port 54325432 destined for the Interface VPC endpoint's security group.
2
Determine the required inbound rules at the destination network interface.
The Interface VPC endpoint's security group must allow inbound TCP port 54325432 from the EC2 instances' security group.
This allows the incoming request to reach the endpoint network interface.
3
Evaluate the stateful nature of security groups for return traffic.
No inbound rules on the EC2 instances or outbound rules on the VPC endpoint are needed.
Security groups are stateful; once a connection is allowed outbound from the EC2 instance or inbound to the VPC endpoint, the corresponding return traffic is automatically allowed.

Key Concept

VPC Interface Endpoints and Stateful Security Groups
Rate this question

Topics

VPC Network Security

More questions from this topic