A company runs an internal reporting application on Amazon EC2 instances in a private subn… — AWS Certified Solutions Architect - Associate

A company runs an internal reporting application on Amazon EC2 instances in a private subnet. The application must connect to an external third-party API service on the internet to retrieve data daily over HTTPS (TCP port $443$ ). A solutions architect has already deployed a NAT Gateway in a public subnet and configured the private subnet's route table to route internet traffic ( $0.0.0.0/0$ ) to the NAT Gateway. The company requires using a custom Network Access Control List (NACL) on the private subnet to restrict outbound traffic to only this API service, whose public IP address is $203.0.113.50$ . Which two configurations must be added to the custom NACL to allow this communication while maintaining the principle of least privilege? (Select TWO.)

An outbound rule allowing TCP port $443$ to destination $203.0.113.50/32$ Answer
An inbound rule allowing TCP ports $1024-65535$ from source $203.0.113.50/32$ Answer
C
An inbound rule allowing TCP port $443$ from source $203.0.113.50/32$
D
An inbound rule allowing TCP port $443$ from the application security group (SG-APP-SG) as the source
E
An outbound rule allowing TCP ports $1024-65535$ to destination $203.0.113.50/32$

Answer

An outbound rule allowing TCP port

443

to destination

203.0.113.50/32

and an inbound rule allowing TCP ports

1024-65535

from source

203.0.113.50/32

Because Network ACLs are stateless, they require explicit rules for both outbound request traffic and inbound response traffic. The outbound connection is initiated towards the external API's service port (TCP

443

), which requires an outbound rule allowing TCP port

443

to the API's IP address

203.0.113.50/32

. The return traffic from the API is destined for the client's ephemeral port range (

1024-65535

), which requires an inbound rule allowing TCP ports

1024-65535

from the API's IP address

203.0.113.50/32

Step-by-Step Solution

Analyze the direction of traffic and connection initiation.

The EC2 instances initiate outbound traffic to the API service on destination port

443

(HTTPS). Therefore, a custom outbound NACL rule is needed to allow TCP port

443

to the specific IP address

203.0.113.50/32

Outbound NACL rules must explicitly permit any outgoing requests.

Determine the return traffic path for stateless network filtering.

Because Network ACLs are stateless, return traffic from the API must be explicitly permitted by an inbound rule. The EC2 instances use client-side ephemeral ports (range

1024-65535

) to establish connections.

The incoming response packets from the API will be destined for the ephemeral ports of the EC2 instances, not port

443

Verify rule constraints and rule types.

Select the rules that specify the correct port directions and IP blocks. Avoid options using security groups, as Network ACL rules do not support them.

Security groups are stateful and work at the instance level, whereas Network ACLs are stateless and work at the subnet boundary using IP CIDRs only.

Key Concept

Stateless nature of Network ACLs requiring explicit ephemeral port inbound rules for outbound connections

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic