Examkin

Question

Difficulty: HardVPC Network Security

A company is deploying a secure database client application on Amazon EC2 instances in a private application subnet (CIDR 10.100.2.0/2410.100.2.0/24) of a VPC. The application must securely query an AWS service using an Interface VPC Endpoint. To enhance security boundaries, the Interface VPC Endpoint is deployed in a separate dedicated endpoint subnet (CIDR 10.100.10.0/2410.100.10.0/24). Both subnets are associated with custom Network Access Control Lists (NACLs) that deny all inbound and outbound traffic by default. The EC2 instances must initiate HTTPS connections on port 443443 to the Interface VPC Endpoint. Which configuration steps must be implemented to allow this communication while maintaining the principle of least privilege? (Select TWO.)

  1. In the Network ACL associated with the private application subnet, add an outbound rule that allows outbound TCP traffic on port 443443 to the destination CIDR 10.100.10.0/2410.100.10.0/24, and an inbound rule that allows inbound TCP traffic on ports 1024−655351024-65535 from the source CIDR 10.100.10.0/2410.100.10.0/24.Answer
  2. In the Network ACL associated with the VPC endpoint subnet, add an inbound rule that allows inbound TCP traffic on port 443443 from the source CIDR 10.100.2.0/2410.100.2.0/24, and an outbound rule that allows outbound TCP traffic on ports 1024−655351024-65535 to the destination CIDR 10.100.2.0/2410.100.2.0/24.Answer
  3. C
    In the Network ACL associated with the private application subnet, add an outbound rule that allows outbound TCP traffic on port 443443 to the destination CIDR 10.100.10.0/2410.100.10.0/24. No corresponding inbound rule is required because Network ACLs automatically allow return traffic.
  4. D
    In the security group attached to the EC2 instances, add an outbound rule allowing TCP traffic on port 443443 to the Interface VPC Endpoint's security group, and an inbound rule allowing TCP traffic on ports 1024−655351024-65535 from the Interface VPC Endpoint's security group.
  5. E
    In the security group attached to the Interface VPC Endpoint, add an inbound rule allowing TCP traffic on port 443443 from the EC2 instances' security group. No security group rules are required on the EC2 instances because security groups are applied at the subnet boundary.

Answer

To establish communication under a default-deny Network ACL architecture, the Network ACL for the application subnet must allow outbound traffic on port 443443 and inbound traffic on ephemeral ports 1024−655351024-65535. Concurrently, the Network ACL for the endpoint subnet must allow inbound traffic on port 443443 and outbound traffic on ephemeral ports 1024−655351024-65535.
Because Network ACLs are stateless, they evaluate traffic in each direction independently. Since the EC2 client initiates an HTTPS request to the Interface VPC Endpoint across subnet boundaries, the application subnet's Network ACL must permit outbound TCP traffic on port 443443 and inbound return traffic on the ephemeral port range (1024−655351024-65535). Reciprocally, the endpoint subnet's Network ACL must permit inbound TCP traffic on port 443443 and outbound return traffic on the ephemeral port range (1024−655351024-65535) back to the application subnet.

Step-by-Step Solution

1
Analyze the statefulness of the firewalls involved.
Security groups are stateful (automatically tracking connections), whereas Network ACLs are stateless (requiring separate rules for inbound and outbound traffic).
This determines whether return traffic rules are required for each layer.
2
Determine the necessary rules for the stateless Network ACL in the client application subnet.
An outbound rule allowing destination port 443443 to the endpoint subnet, and an inbound rule allowing source ephemeral ports 1024−655351024-65535 from the endpoint subnet.
Since the client initiates the connection, outbound traffic leaves on port 443443 and returns on ephemeral ports.
3
Determine the necessary rules for the stateless Network ACL in the VPC endpoint subnet.
An inbound rule allowing destination port 443443 from the application subnet, and an outbound rule allowing target ephemeral ports 1024−655351024-65535 to the application subnet.
Since the VPC endpoint receives the connection, inbound traffic enters on port 443443 and return traffic is sent back to the client's ephemeral port range.

Key Concept

The stateless nature of Network ACLs requiring explicit configuration for both request and response traffic paths, compared to the stateful nature of Security Groups.
Estimated Time:2m 30s
Rate this question

Topics

VPC Network Security

More questions from this topic