A gaming analytics platform runs on Amazon EC2 instances in a private VPC subnet (10.10.2.… — AWS Certified Solutions Architect - Associate

A gaming analytics platform runs on Amazon EC2 instances in a private VPC subnet ( $10.10.2.0/24$ ). The instances successfully retrieve session logs from Amazon S3 in the same AWS Region using an S3 Gateway VPC Endpoint. However, when the instances attempt to send batch reports to an external audit API (`https://audit.example.com`) via a NAT Gateway located in a public subnet ( $10.10.1.0/24$ ), the connections consistently time out.

The private subnet's Network ACL (NACL) is configured as follows:
- Inbound Rule 100: Allow TCP ports $1024-65535$ from $10.10.1.0/24$
- Inbound Rule 110: Allow TCP ports $1024-65535$ from the S3 Prefix List (`pl-xxxxxx`)
- Outbound Rule 100: Allow TCP port 443 to $10.10.1.0/24$
- Outbound Rule 110: Allow TCP port 443 to the S3 Prefix List (`pl-xxxxxx`)
- Default rule: Deny all other traffic

The EC2 instances are associated with a Security Group that has the following rules:
- Inbound: Allow TCP port 443 from $10.10.1.0/24$
- Outbound: Allow TCP port 443 to $0.0.0.0/0$

Which of the following configurations will resolve the timeout issue while maintaining the principle of least privilege?

Modify the private subnet's Network ACL to allow outbound TCP port 443 to $0.0.0.0/0$ and inbound TCP ports $1024-65535$ from $0.0.0.0/0$ .Answer
B
Modify the EC2 instances' Security Group inbound rules to allow TCP ports $1024-65535$ from $10.10.1.0/24$ , and add a Network ACL outbound rule to allow TCP port 443 to the NAT Gateway's private IP address.
C
Add a Route Table entry to forward traffic for `audit.example.com` to the S3 Gateway VPC Endpoint, and modify the Network ACL to allow inbound TCP port 443 from $10.10.1.0/24$ .
D
Change the EC2 instances' Security Group outbound rules to only allow TCP port 443 to $10.10.1.0/24$ since all traffic is routed through the NAT Gateway, and add an inbound Network ACL rule allowing TCP port 443 from $0.0.0.0/0$ .

Answer

Modify the private subnet's Network ACL to allow outbound TCP port 443 to

0.0.0.0/0

and inbound TCP ports

1024-65535

from

0.0.0.0/0

The correct option correctly identifies that Network ACLs (NACLs) are stateless and inspect the actual source and destination IP addresses in the packet headers. When EC2 instances in the private subnet send packets to the external API, the destination IP remains the API's public IP address (not the NAT Gateway's IP). Consequently, the outbound NACL must allow traffic to

0.0.0.0/0

on TCP port 443. Similarly, when the return traffic arrives, the source IP is the API's public IP, and the destination port is the ephemeral port (

1024-65535

) allocated by the EC2 instance. Therefore, the inbound NACL must allow traffic from

0.0.0.0/0

on ports

1024-65535

. Security Groups are stateful and automatically permit return traffic, so no changes to the Security Group are needed.

Step-by-Step Solution

Analyze how packets are routed and formatted when sent from private EC2 instances to an external public IP via a NAT Gateway.

The routing table forwards packets to the NAT Gateway ENI, but the destination IP in the packet's IP header remains the public IP of `audit.example.com`, not the NAT Gateway's IP.

Understanding that network routing does not rewrite the destination IP address of outbound packets at the subnet boundary.

Evaluate the stateless Network ACL (NACL) behavior for outbound traffic.

Since the destination IP is a public address, the packet does not match the local public subnet CIDR (

10.10.1.0/24

). The outbound NACL blocks the packet because there is no rule allowing TCP port 443 to

0.0.0.0/0

Network ACLs are stateless and must explicitly allow the outbound destination IP address.

Evaluate the stateless NACL behavior for inbound return traffic.

Return packets from the external API arrive via the NAT Gateway. The source IP in the packet header is the public IP of the external API, and the destination port is an ephemeral port (

1024-65535

). The inbound NACL blocks this return traffic because it only allows ephemeral ports from the public subnet CIDR, not from

0.0.0.0/0

Since NACLs are stateless, return traffic must be explicitly allowed inbound based on the original source IP and ephemeral destination port.

Verify Security Group requirements.

Security groups are stateful. The outbound rule allows TCP port 443 to

0.0.0.0/0

, which matches both the S3 endpoint and the public API. No inbound security group rules are required because return traffic is automatically allowed.

Confirming that the stateful firewall layer is already correctly configured and does not block the return traffic.

Key Concept

Stateless Network ACLs evaluate IP headers based on original source and destination IPs, which are preserved across NAT Gateway routing. Ephemeral ports must be allowed in the return direction.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic