Examkin

Question

Difficulty: MediumNetwork Security Controls (Security Groups and NACLs)

A SysOps Administrator is troubleshooting a connectivity issue where an application on Amazon EC2 instances in Subnet A (CIDR 172.16.1.0/24172.16.1.0/24) cannot connect to a PostgreSQL database on Amazon EC2 instances in Subnet B (CIDR 172.16.2.0/24172.16.2.0/24). Both subnets are associated with different Network Access Control Lists (NACLs). The application security group allows outbound traffic to the database security group on TCP port 5432. The database security group allows inbound traffic from the application security group on TCP port 5432. Which two configuration changes must be made to the subnet NACLs to successfully permit this database traffic? (Select TWO.)

  1. In the Network ACL associated with Subnet A, add an outbound rule allowing TCP port 5432 to Subnet B's CIDR, and an inbound rule allowing TCP ports 1024−655351024-65535 from Subnet B's CIDR.Answer
  2. In the Network ACL associated with Subnet B, add an inbound rule allowing TCP port 5432 from Subnet A's CIDR, and an outbound rule allowing TCP ports 1024−655351024-65535 to Subnet A's CIDR.Answer
  3. C
    In the Network ACL associated with Subnet B, add an inbound rule allowing TCP port 5432 from Subnet A's CIDR. No outbound rules are required because Network ACLs are stateful.
  4. D
    In the Network ACL associated with Subnet A, add an outbound rule allowing TCP port 5432 to Subnet B's CIDR. No inbound rules are required because Network ACLs automatically track connection states.
  5. E
    In the Network ACL associated with Subnet A, add an inbound rule allowing TCP port 5432 from Subnet B's CIDR, and an outbound rule allowing TCP ports 1024−655351024-65535 to Subnet B's CIDR.

Answer

The correct configurations are to add rules to the Network ACL of Subnet A allowing outbound traffic on TCP port 5432 and inbound traffic on the ephemeral port range 1024−655351024-65535, and to the Network ACL of Subnet B allowing inbound traffic on TCP port 5432 and outbound traffic on the ephemeral port range 1024−655351024-65535.
The correct options properly configure the stateless Network ACLs on both sides. In the subnet containing the application, we must allow outbound traffic on TCP port 5432 to the database CIDR and inbound traffic on the ephemeral port range 1024−655351024-65535 from the database CIDR. In the subnet containing the database, we must allow inbound traffic on TCP port 5432 from the application CIDR and outbound traffic on the ephemeral port range 1024−655351024-65535 to the application CIDR.

Step-by-Step Solution

1
Analyze the connection flow direction.
The application in Subnet A initiates a connection to the PostgreSQL database in Subnet B on TCP port 5432.
This establishes that port 5432 is outbound from Subnet A and inbound to Subnet B, while the response traffic will be outbound from Subnet B and inbound to Subnet A on ephemeral ports.
2
Evaluate the state requirements for the Network ACLs.
Network ACLs are stateless. Therefore, both the request path (port 5432) and the response path (ephemeral ports 1024−655351024-65535) must be explicitly allowed in both subnets' Network ACLs.
Unlike security groups, Network ACLs do not automatically allow return traffic.
3
Formulate the required rules for Subnet A.
Subnet A's Network ACL needs an outbound rule to allow TCP 5432 to Subnet B's CIDR, and an inbound rule to allow TCP 1024−655351024-65535 from Subnet B's CIDR.
This permits the outgoing database request and the incoming response.
4
Formulate the required rules for Subnet B.
Subnet B's Network ACL needs an inbound rule to allow TCP 5432 from Subnet A's CIDR, and an outbound rule to allow TCP 1024−655351024-65535 to Subnet A's CIDR.
This permits the incoming database request and the outgoing response.

Key Concept

Network ACLs are stateless, meaning return traffic must be explicitly allowed. In addition to the destination port, rules must allow the return traffic on ephemeral ports (1024−655351024-65535).
Estimated Time:2m 0s
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic