Examkin

Question

Difficulty: MediumVPC Flow Logs and Network Monitoring

A SysOps Administrator is troubleshooting a connection issue where an external client cannot fully establish a connection to an Amazon EC2 instance in a public subnet. The EC2 instance's security group has an inbound rule allowing TCP port 80 from all sources, and the default outbound rule allowing all traffic. The subnet's Network Access Control List (NACL) has an inbound rule allowing TCP port 80 from all sources, but the outbound NACL rules do not allow any ephemeral port traffic (ports 1024-65535) back to the client. VPC Flow Logs are enabled for the network interface of the EC2 instance. Which pattern of ACCEPT and REJECT records will the administrator observe in the VPC Flow Logs for this connection attempt?

  1. An ACCEPT record for the inbound traffic, and a REJECT record for the outbound trafficAnswer
  2. B
    A REJECT record for the inbound traffic, because the stateless Network ACL blocks the connection from being established initially
  3. C
    ACCEPT records for both the inbound and outbound traffic, because the stateful security group automatically allows the return traffic
  4. D
    An ACCEPT record for the inbound traffic, and no records for the outbound traffic because VPC Flow Logs do not log packets dropped by Network ACLs

Answer

An ACCEPT record for the inbound traffic, and a REJECT record for the outbound traffic
The correct answer shows an ACCEPT record for the inbound traffic and a REJECT record for the outbound traffic. Since the inbound rules of both the security group and the Network ACL permit traffic on port 80, the inbound connection request successfully reaches the network interface and is logged as an ACCEPT. However, because the Network ACL is stateless, it does not automatically allow response traffic. Without an outbound Network ACL rule allowing traffic to the client's ephemeral ports, the return packets are blocked and logged as a REJECT.

Step-by-Step Solution

1
Evaluate the inbound path of the connection
The inbound packet targeting port 80 is allowed by both the inbound Network ACL rule and the inbound security group rule. This results in an ACCEPT record in the VPC Flow Logs.
Both firewall layers must permit the traffic for it to reach the network interface and be logged as accepted.
2
Evaluate the outbound response path of the connection
The EC2 instance sends a response packet back to the client's ephemeral port. While the stateful security group automatically allows this response, the stateless Network ACL lacks a rule to permit outbound traffic to ephemeral ports. The packet is dropped at the subnet boundary, resulting in a REJECT record.
Network ACLs are stateless, meaning return traffic is not automatically tracked or allowed; it must be explicitly permitted by outbound rules.

Key Concept

Stateful vs. Stateless network filtering evaluation in VPC Flow Logs
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic