Examkin

Question

Difficulty: EasyVPC Security Controls and Traffic Analysis

A SysOps Administrator is configuring network security for a two-tier application. Amazon EC2 instances in the application subnet must be able to initiate database connections to Amazon RDS DB instances in the database subnet on TCP port 1433. The database subnet's Network Access Control List (NACL) is currently configured with default deny rules.

Which two rules must be added to the database subnet's NACL to allow this communication? (Select TWO.)

  1. An inbound rule to allow TCP traffic from the application subnet IP range on destination port 1433Answer
  2. An outbound rule to allow TCP traffic to the application subnet IP range on destination ports 1024-65535Answer
  3. C
    An outbound rule to allow TCP traffic to the application subnet IP range on destination port 1433 only
  4. D
    An inbound rule to allow TCP traffic from the application subnet IP range on destination ports 1024-65535
  5. E
    An outbound rule to the database security group to allow TCP traffic to the application subnet IP range on destination ports 1024-65535

Answer

An inbound rule to allow TCP traffic from the application subnet IP range on destination port 1433, and an outbound rule to allow TCP traffic to the application subnet IP range on destination ports 1024-65535.
The correct answers describe the stateless configuration required for a NACL. Specifically, an inbound rule must allow TCP traffic from the application subnet on destination port 1433 to accept the incoming connections, and an outbound rule must allow TCP traffic to the application subnet on the ephemeral port range (1024-65535) to allow response packets.

Step-by-Step Solution

1
Identify the communication flow and port requirements.
The application servers initiate a connection to the database on TCP port 1433. The database answers using client-side ephemeral ports (range 1024-65535).
This establishes the necessary ports for both inbound requests and outbound responses.
2
Configure the inbound rule on the database subnet's NACL.
Allow TCP traffic from the application subnet's CIDR block targeting destination port 1433.
This allows connection requests to enter the database subnet.
3
Configure the outbound rule on the database subnet's NACL.
Allow TCP traffic to the application subnet's CIDR block targeting destination ports 1024-65535.
Because NACLs are stateless, return traffic must be explicitly permitted outbound through the ephemeral port range.

Key Concept

Network Access Control Lists (NACLs) are stateless, requiring explicit rules for both inbound request traffic and outbound return traffic (which uses ephemeral ports).
Estimated Time:1m 0s
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic