An organization has deployed an Application Load Balancer (ALB) in a public subnet to dist… — AWS Certified SysOps Administrator - Associate

An organization has deployed an Application Load Balancer (ALB) in a public subnet to distribute traffic to a fleet of Amazon EC2 web instances residing in a private subnet. The public subnet CIDR is $10.0.1.0/24$ and the private subnet CIDR is $10.0.2.0/24$ .

The security controls are configured as follows:
- The ALB's security group allows inbound TCP traffic on ports $80$ and $443$ from $0.0.0.0/0$ , and allows all outbound traffic.
- The EC2 instances' security group allows inbound TCP traffic on ports $80$ and $443$ from the ALB's security group.
- The Network ACL (NACL) for the private subnet has an inbound rule allowing TCP traffic on ports $80$ and $443$ from $10.0.1.0/24$ , and an outbound rule allowing all traffic to $0.0.0.0/0$ .
- The Network ACL (NACL) for the public subnet has inbound rules allowing TCP traffic on ports $80$ and $443$ from $0.0.0.0/0$ . However, its outbound rules are restricted to only allow TCP traffic on ports $80$ and $443$ to $0.0.0.0/0$ .

Users report that connection attempts to the ALB timeout.

Which of the following changes will resolve this issue and restore connectivity?

Modify the public subnet's outbound Network ACL rules to allow outbound TCP traffic to the ephemeral port range $1024$ - $65535$ for destination $0.0.0.0/0$ .Answer
B
Add an outbound rule to the EC2 instances' security group to allow TCP traffic on the ephemeral port range $1024$ - $65535$ to the ALB's security group.
C
Add a route to the private subnet's route table targeting the Internet Gateway for destination $0.0.0.0/0$ .
D
Associate a Gateway Load Balancer endpoint with the route tables of both the public and private subnets.

Answer

Modify the public subnet's outbound Network ACL rules to allow outbound TCP traffic to the ephemeral port range

1024

65535

for destination

0.0.0.0/0

Network ACLs are stateless, meaning that both inbound and outbound traffic must be explicitly allowed. When a client initiates a connection to the Application Load Balancer, the source port of the client's request is a random ephemeral port (typically

1024

65535

). The return traffic from the ALB back to the client will have the client's ephemeral port as the destination port. Because the public subnet's outbound Network ACL only allows outbound traffic on ports

80

and

443

, the return traffic to the client's ephemeral port is blocked. Allowing outbound TCP traffic to the range

1024

65535

resolves this issue.

Step-by-Step Solution

Trace the lifecycle of a client connection to the ALB and identify the ports involved.

The client initiates a connection from a random ephemeral port (typically

1024

65535

) to the ALB on port

80

443

Understanding the source and destination ports in both directions is critical for troubleshooting stateless firewalls like Network ACLs.

Evaluate the stateful vs. stateless behavior of the security groups and Network ACLs in the path.

The security groups are stateful and automatically allow return traffic. The Network ACLs are stateless, meaning outbound return traffic must be explicitly allowed. The public subnet's outbound Network ACL restricts outbound traffic to destination ports

80

and

443

only.

This restriction blocks the response packets sent from the ALB back to the client's ephemeral port, causing the client connection to time out.

Formulate a rule modification to permit the blocked return traffic.

The public subnet's outbound Network ACL must be updated to allow outbound TCP traffic to the destination range

1024

65535

for

0.0.0.0/0

This allows the stateless Network ACL to permit return traffic back to the client's ephemeral ports.

Key Concept

Stateless Network ACL rule evaluation and ephemeral port requirements

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic