A company runs an internal reporting service on Amazon EC2 instances in a management subne… — AWS Certified Solutions Architect - Associate

A company runs an internal reporting service on Amazon EC2 instances in a management subnet, and a database indexing service on EC2 instances in a data subnet within the same VPC. A solutions architect must configure the VPC network security to meet the following requirements:
1. The reporting service must be able to initiate TCP connections to the database indexing service on port $8080$ .
2. The database indexing service must be prevented from initiating any connections to the reporting service.
3. Both services must be able to send responses to any successfully established connections.

Which security group configuration will meet these requirements with the least administrative effort?

Configure the reporting service security group with an outbound rule allowing TCP traffic to the database indexing service security group on port $8080$ . Configure the database indexing service security group with an inbound rule allowing TCP traffic from the reporting service security group on port $8080$ . Do not add any inbound rules to the reporting service security group or outbound rules to the database indexing service security group.Answer
B
Configure the reporting service security group with an outbound rule allowing TCP traffic to the database indexing service security group on port $8080$ and an inbound rule allowing return TCP traffic from it. Configure the database indexing service security group with an inbound rule allowing TCP traffic from the reporting service security group on port $8080$ and an outbound rule allowing return TCP traffic to it.
C
Configure a Network ACL on the management subnet to allow outbound TCP traffic to the data subnet on port $8080$ , and configure a Network ACL on the data subnet to allow inbound TCP traffic from the management subnet on port $8080$ . Remove all security group rules to simplify configuration.
D
Deploy AWS WAF in both subnets. Configure Web ACL rules on the management subnet to block all incoming web requests from the data subnet, and configure Web ACL rules on the data subnet to allow incoming requests from the management subnet on port $8080$ .

Answer

Configure the security group of the initiating service with an outbound rule pointing to the destination service's security group, and configure the destination service's security group with an inbound rule allowing traffic from the initiating service's security group.

AWS Security Groups are stateful. When a rule allows outbound traffic to proceed (such as the reporting service connecting to the database indexing service), the return response traffic is automatically permitted regardless of any inbound rules. Similarly, when an inbound rule allows traffic to reach the database indexing service, the outbound response is automatically allowed. Therefore, configuring only the outbound rule on the initiator and the inbound rule on the receiver is the most secure configuration with the least administrative effort.

Step-by-Step Solution

Analyze connection requirements

The reporting service is the initiator (requires outbound permission on port

8080

). The database indexing service is the receiver (requires inbound permission on port

8080

Security group rules must be aligned with connection initiation direction.

Leverage security group statefulness

Since security groups are stateful, response traffic is automatically allowed. Explicit inbound rules for return traffic on the reporting service and outbound rules for return traffic on the database indexing service are not required.

This minimizes the number of security group rules and administrative overhead.

Apply least privilege rules to security groups

Allow outbound TCP on port

8080

from the reporting service security group to the database indexing service security group. Allow inbound TCP on port

8080

to the database indexing service security group from the reporting service security group.

This configuration secures the communication path without exposing either service to unauthorized connection initiations.

Key Concept

Stateful behavior of AWS Security Groups

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic