A financial services company is deploying a two-tier application inside a virtual private … — AWS Certified Solutions Architect - Associate

A financial services company is deploying a two-tier application inside a virtual private cloud (VPC). The application consists of backend processing Amazon EC2 instances running in Subnet A ( $172.16.1.0/24$ ) and a PostgreSQL database instance running in Subnet B ( $172.16.2.0/24$ ). The backend instances need to access the database on TCP port $5432$ , but all other traffic between the subnets must be blocked. The company requires a defense-in-depth network security architecture using both Security Groups and Network ACLs (NACLs). Which TWO configuration steps should the solutions architect perform to meet these security requirements?

Configure the database security group to allow inbound TCP traffic on port $5432$ from the security group of the backend processing instances.Answer
Configure the Network ACL for Subnet B to allow inbound TCP traffic on port $5432$ from Subnet A ( $172.16.1.0/24$ ) and allow outbound TCP traffic on ephemeral ports ( $1024-65535$ ) to Subnet A ( $172.16.1.0/24$ ).Answer
C
Configure the database security group to allow inbound TCP traffic on port $5432$ from the backend processing instances' security group, and add an outbound rule allowing TCP traffic on ephemeral ports ( $1024-65535$ ) to the backend instances' security group.
D
Configure the Network ACL for Subnet B to allow inbound TCP traffic on port $5432$ from Subnet A ( $172.16.1.0/24$ ), relying on the stateful nature of Network ACLs to automatically allow the return database response traffic.
E
Deploy AWS WAF and associate it directly with Subnet B to inspect SQL traffic and prevent SQL injection attacks from Subnet A.

Answer

Configuring the database security group to allow inbound TCP traffic on port

5432

from the backend processing instances' security group, and configuring the Network ACL for Subnet B to allow inbound TCP traffic on port

5432

from Subnet A and outbound TCP traffic on ephemeral ports (

1024-65535

) to Subnet A.

The correct architecture uses a combination of a stateful security group on the database instance and a stateless Network ACL on Subnet B. The security group configuration must allow inbound traffic from the backend instances' security group on port

5432

, which automatically allows return traffic. The Network ACL configuration must allow inbound traffic from the backend subnet on port

5432

and also explicitly allow outbound return traffic to the backend subnet on ephemeral ports because Network ACLs are stateless.

Step-by-Step Solution

Evaluate the Security Group configuration needed for the database instance.

Determine that the database security group must allow inbound TCP port

5432

traffic from the backend instances' security group. No outbound rule is required since security groups are stateful.

This establishes least-privilege control at the instance layer using stateful firewalls.

Evaluate the Network ACL configuration required for Subnet B.

Determine that Subnet B's Network ACL must allow inbound TCP port

5432

traffic from Subnet A's CIDR (

172.16.1.0/24

). Because Network ACLs are stateless, return traffic must also be permitted by adding an outbound rule for ephemeral ports (

1024-65535

) targeting Subnet A's CIDR.

This establishes subnet-level security filtering using stateless firewalls.

Key Concept

Distinguishing between the stateful behavior of Security Groups and the stateless behavior of Network ACLs in Amazon VPC.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic