An organization is designing a secure two-tier application in a VPC. The application serve… — AWS Certified Solutions Architect - Associate

An organization is designing a secure two-tier application in a VPC. The application servers reside in a private subnet (Subnet A: $192.168.1.0/24$ ), and the database servers reside in another private subnet (Subnet B: $192.168.2.0/24$ ). A solutions architect must restrict database access so that database instances in Subnet B only receive database traffic on TCP port $5432$ from Subnet A. The security architecture requires utilizing both Network ACLs (NACLs) and Security Groups to enforce this isolation. Which combination of configuration rules meets these requirements while ensuring the database can successfully respond to the application servers?

Configure the database security group with an inbound rule allowing TCP port $5432$ from the application security group. Configure the Subnet B NACL with an inbound rule allowing TCP port $5432$ from $192.168.1.0/24$ and an outbound rule allowing TCP ports $1024-65535$ to $192.168.1.0/24$ .Answer
B
Configure the database security group with an inbound rule allowing TCP port $5432$ from the application security group and an outbound rule allowing TCP ports $1024-65535$ to the application security group. Configure the Subnet B NACL with an inbound rule allowing TCP port $5432$ from $192.168.1.0/24$ .
C
Configure the database security group with an inbound rule allowing TCP port $5432$ from the application security group and an outbound rule allowing TCP port $5432$ to the application security group. Configure the Subnet B NACL with an inbound rule allowing TCP port $5432$ from $192.168.1.0/24$ and an outbound rule allowing TCP port $5432$ to $192.168.1.0/24$ .
D
Configure an AWS WAF web ACL associated with the database subnet to inspect and allow incoming PostgreSQL traffic on TCP port $5432$ from Subnet A. Configure the database security group with an inbound rule allowing TCP port $5432$ from the application security group.

Answer

Configure the database security group with an inbound rule allowing TCP port 5432 from the application security group, and configure the Subnet B Network ACL with an inbound rule allowing TCP port 5432 from Subnet A's CIDR block and an outbound rule allowing TCP ports 1024-65535 to Subnet A's CIDR block.

The correct answer combines the stateful nature of security groups with the stateless nature of network ACLs. Because security groups are stateful, allowing inbound TCP port 5432 from the application security group is sufficient to allow bidirectional traffic. In contrast, Network ACLs are stateless, requiring both inbound and outbound rules. The inbound rule must allow TCP port 5432 from the application subnet CIDR block (192.168.1.0/24). The outbound rule must allow TCP traffic to the client's ephemeral port range (1024-65535) back to Subnet A's CIDR block.

Step-by-Step Solution

Analyze Security Group requirements for stateful traffic tracking.

The database security group needs an inbound rule for TCP port 5432 from the application security group. No outbound rule is needed on the security group because security groups are stateful and automatically allow return traffic.

Security groups automatically track connection states, allowing return traffic for established connections.

Analyze Network ACL (NACL) inbound requirements for stateless filtering.

The database subnet NACL (Subnet B) requires an inbound rule allowing TCP port 5432 traffic from the application subnet CIDR block (192.168.1.0/24).

NACLs are stateless and apply at the subnet level, so inbound traffic must be explicitly allowed.

Analyze Network ACL (NACL) outbound requirements for stateless return traffic.

The database subnet NACL (Subnet B) requires an outbound rule allowing TCP traffic to destination ports 1024-65535 back to Subnet A's CIDR block (192.168.1.0/24).

Since NACLs are stateless, return traffic must be explicitly allowed. Because the client application initiated the request from an ephemeral port, the database response is sent to that ephemeral port (range 1024-65535).

Key Concept

Stateful Security Groups vs Stateless Network ACLs (NACLs) and Ephemeral Ports

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic