Examkin

Question

Difficulty: MediumVPC Network Security

An e-commerce company hosts its inventory application tier on Amazon EC2 instances inside a public subnet with CIDR block 172.16.10.0/24172.16.10.0/24. The application connects to a MySQL database cluster running on EC2 instances in a private subnet with CIDR block 172.16.20.0/24172.16.20.0/24. A solutions architect is configuring a new custom Network ACL for the private subnet. The architect adds an inbound rule to the Network ACL allowing TCP port 33063306 from the public subnet CIDR block 172.16.10.0/24172.16.10.0/24. The database security group already permits inbound traffic on port 33063306 from the application instances. However, after applying the new Network ACL, database connections from the application tier fail. Which action will resolve this issue?

  1. A
    Add an outbound rule to the database instances' security group that allows outbound TCP traffic to 172.16.10.0/24172.16.10.0/24 on port 33063306.
  2. Add an outbound rule to the private subnet's Network ACL that allows outbound TCP traffic to 172.16.10.0/24172.16.10.0/24 on ephemeral ports 1024−655351024-65535.Answer
  3. C
    Change the private subnet's Network ACL inbound rule to allow all traffic, and configure the database instances' security group as stateless to handle the return traffic dynamically.
  4. D
    Add an outbound rule to the private subnet's Network ACL that allows outbound TCP traffic to 172.16.10.0/24172.16.10.0/24 on port 33063306.

Answer

Add an outbound rule to the private subnet's Network ACL that allows outbound TCP traffic to 172.16.10.0/24172.16.10.0/24 on ephemeral ports 1024−655351024-65535.
The correct answer is to add an outbound rule to the private subnet's Network ACL allowing traffic to the public subnet on ephemeral ports. Network ACLs are stateless network boundaries. When an inbound connection on port 33063306 is allowed into the private subnet, the return traffic from the database to the application tier uses a high-numbered ephemeral destination port. Because Network ACLs do not automatically track session state, an outbound rule must explicitly permit this return traffic on ephemeral ports (1024−655351024-65535) for the connection to succeed.

Step-by-Step Solution

1
Analyze the stateful and stateless characteristics of the security controls in place.
The database security group is stateful, meaning it automatically allows outbound return traffic. The Network ACL is stateless, meaning it evaluates inbound and outbound traffic independently.
Understanding that Network ACLs require explicit rules for both directions is critical to resolving connectivity issues.
2
Determine the destination port used by the return traffic from the database to the application client.
The client establishes a connection from an ephemeral source port (typically 1024−655351024-65535) to the database destination port (33063306). The return traffic from the database back to the client will have a destination port in the ephemeral range.
Stateless filtering requires configuring outbound rules that match the destination ports of the response packets.
3
Configure the outbound rule on the private subnet's Network ACL to allow the ephemeral port range to the client's subnet.
Adding an outbound rule allowing TCP traffic to the public subnet (172.16.10.0/24172.16.10.0/24) on ports 1024−655351024-65535 enables the return traffic to pass successfully.
This completes the bidirectional path required by stateless Network ACLs for TCP handshakes and data exchange.

Key Concept

Network ACLs are stateless and require explicit outbound rules to permit return traffic. When a client connects to a server, the server responds to the client's ephemeral source port. Therefore, the stateless firewall protecting the server must allow outbound traffic to the client's IP address range on ephemeral ports (1024−655351024-65535).
Rate this question

Topics

VPC Network Security

More questions from this topic