An organization is deploying an internal processing application on Amazon EC2 instances in… — AWS Certified Solutions Architect - Associate

An organization is deploying an internal processing application on Amazon EC2 instances in a private subnet (CIDR $10.0.2.0/24$ ). The application must securely consume a proprietary database API hosted by a third-party vendor in another AWS account using an Interface VPC Endpoint. The endpoint network interfaces are located in a separate dedicated subnet (CIDR $10.0.3.0/24$ ) within the same VPC. Traffic is restricted to TCP port $443$ . The VPC uses custom Network Access Control Lists (NACLs) associated with each subnet, both of which are currently configured with a default deny-all rule. To meet security compliance, the EC2 instances must only be allowed to initiate outbound connections to the Interface VPC Endpoint, and no other external traffic is permitted. Which combination of NACL and Security Group configurations will allow this private connection while adhering to the principle of least privilege?

For the application subnet NACL, add an outbound rule allowing TCP port $443$ to $10.0.3.0/24$ and an inbound rule allowing TCP ports $1024$ - $65535$ from $10.0.3.0/24$ . For the endpoint subnet NACL, add an inbound rule allowing TCP port $443$ from $10.0.2.0/24$ and an outbound rule allowing TCP ports $1024$ - $65535$ to $10.0.2.0/24$ . Associate a Security Group with the EC2 instances allowing outbound TCP port $443$ to the endpoint Security Group, and associate a Security Group with the Interface Endpoint allowing inbound TCP port $443$ from the EC2 Security Group.Answer
B
For the application subnet NACL, add an outbound rule allowing TCP port $443$ to $10.0.3.0/24$ and an inbound rule allowing TCP port $443$ from $10.0.3.0/24$ . For the endpoint subnet NACL, add an inbound rule allowing TCP port $443$ from $10.0.2.0/24$ and an outbound rule allowing TCP port $443$ to $10.0.2.0/24$ . Associate a Security Group with the EC2 instances allowing outbound TCP port $443$ to the endpoint Security Group, and associate a Security Group with the Interface Endpoint allowing inbound TCP port $443$ from the EC2 Security Group.
C
For the application subnet NACL, add an outbound rule allowing TCP port $443$ to $10.0.3.0/24$ and an inbound rule allowing TCP ports $1024$ - $65535$ from $10.0.3.0/24$ . For the endpoint subnet NACL, add an inbound rule allowing TCP port $443$ from $10.0.2.0/24$ and an outbound rule allowing TCP ports $1024$ - $65535$ to $10.0.2.0/24$ . Associate a Security Group with the EC2 instances allowing outbound TCP port $443$ and inbound TCP ports $1024$ - $65535$ , and associate a Security Group with the Interface Endpoint allowing inbound TCP port $443$ and outbound TCP ports $1024$ - $65535$ .
D
For the application subnet NACL, add an outbound rule allowing TCP port $443$ to $10.0.3.0/24$ . For the endpoint subnet NACL, add an inbound rule allowing TCP port $443$ from $10.0.2.0/24$ . Do not configure inbound application NACL rules or outbound endpoint NACL rules. Associate a Security Group with the EC2 instances allowing outbound TCP port $443$ to the endpoint Security Group, and associate a Security Group with the Interface Endpoint allowing inbound TCP port $443$ from the EC2 Security Group.

Answer

The correct configuration requires setting up stateless NACL rules that permit outbound traffic on port

443

and inbound return traffic on the ephemeral port range (

1024

65535

) for the application subnet, and the inverse rules for the endpoint subnet (inbound on port

443

and outbound on ephemeral ports). The stateful security groups require only the outbound rule from the application instances to the endpoint on port

443

, and the inbound rule on the endpoint from the application instances on port

443

The correct configuration combines stateful security group rules with stateless NACL rules. For the stateful security groups, only a one-way allowance is required: the EC2 instances need outbound access to the endpoint, and the endpoint needs inbound access from the instances. The return traffic is handled automatically by the stateful firewall. For the stateless NACLs, rules must be explicitly created for both request and response traffic. The application subnet NACL must allow outbound traffic on destination port

443

and inbound return traffic on ephemeral ports (

1024

65535

). The endpoint subnet NACL must allow inbound traffic on port

443

and outbound return traffic on ephemeral ports (

1024

65535

Step-by-Step Solution

Analyze the stateful security group requirements for both the client (EC2 instances) and the destination (Interface VPC Endpoint).

Since security groups are stateful, the client security group only needs an outbound rule to allow TCP port

443

to the endpoint's security group. The endpoint's security group only needs an inbound rule to allow TCP port

443

from the client's security group. Return traffic is tracked and allowed automatically.

Establishing stateful rules prevents unnecessary port exposure, minimizing security risk and following the principle of least privilege.

Determine the stateless Network ACL (NACL) requirements for the application subnet.

The application subnet NACL must allow outbound TCP traffic to the endpoint subnet (

10.0.3.0/24

) on destination port

443

. Additionally, it must allow inbound return traffic from the endpoint subnet (

10.0.3.0/24

) on the client's ephemeral port range (

1024

65535

NACLs are stateless and evaluate traffic in both directions independently; without allowing return traffic on ephemeral ports, TCP handshakes cannot complete.

Determine the stateless Network ACL (NACL) requirements for the endpoint subnet.

The endpoint subnet NACL must allow inbound TCP traffic from the application subnet (

10.0.2.0/24

) on port

443

. It must also allow outbound return traffic to the application subnet (

10.0.2.0/24

) on ephemeral ports (

1024

65535

This matches the counterpart stateless flow, ensuring that incoming packets can be received by the endpoint network interfaces and the responses can leave the subnet.

Key Concept

Stateless vs Stateful Network Security in AWS VPCs

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic