Examkin

Question

Difficulty: MediumNetwork Security Controls (Security Groups and NACLs)

A SysOps Administrator is setting up administrative access to a Windows-based bastion host running on an Amazon EC2 instance. The instance is deployed in a public subnet associated with a custom Network Access Control List (NACL). Administrators need to establish Remote Desktop Protocol (RDP) sessions from the corporate office network (203.0.113.0/24203.0.113.0/24). The instance's security group already allows inbound TCP port 33893389 traffic from the corporate network, but connections are still timing out.

Which of the following rules must be added to the custom NACL to resolve this connectivity issue? (Select TWO.)

  1. An inbound rule that allows incoming TCP traffic on port 33893389 from the corporate network range of 203.0.113.0/24203.0.113.0/24Answer
  2. An outbound rule that allows outgoing TCP traffic on port range 1024−655351024-65535 to the corporate network range of 203.0.113.0/24203.0.113.0/24Answer
  3. C
    An outbound rule that allows outgoing TCP traffic on port 33893389 to the corporate network range of 203.0.113.0/24203.0.113.0/24
  4. D
    An inbound rule that allows incoming TCP traffic on port range 1024−655351024-65535 from the corporate network range of 203.0.113.0/24203.0.113.0/24
  5. E
    An outbound rule that allows outgoing TCP traffic on port range 1024−655351024-65535 to the security group of the corporate network

Answer

To resolve the RDP connectivity issue, the custom NACL must be configured with an inbound rule allowing TCP port 33893389 traffic from the corporate IP range, and an outbound rule allowing TCP port range 1024−655351024-65535 traffic back to the corporate IP range.
Because Network Access Control Lists (NACLs) are stateless, they evaluate inbound and outbound traffic independently. To allow administrators to establish RDP sessions, the NACL must allow inbound RDP traffic on TCP port 33893389 from the corporate IP range, and it must also allow outbound response traffic to the corporate IP range on ephemeral ports (1024−655351024-65535) where the client expects the return packets.

Step-by-Step Solution

1
Analyze the stateless nature of NACLs.
Unlike stateful security groups, custom NACLs require explicit rules for both the inbound request path and the outbound response path.
Without outbound rules matching the response traffic, return packets are dropped by the default outbound deny rule.
2
Identify the ports required for the inbound connection.
The target Windows host listens on TCP port 33893389 for RDP. Therefore, an inbound rule permitting TCP port 33893389 from the client's network block (203.0.113.0/24203.0.113.0/24) is required.
To permit the client's connection request to reach the EC2 instance.
3
Identify the ports required for the outbound response traffic.
The client operating system initiates the connection using a source port from the ephemeral port range (1024−655351024-65535). The host's response is sent back to this client port. An outbound rule permitting TCP ports 1024−655351024-65535 to the client's network block (203.0.113.0/24203.0.113.0/24) is required.
To permit the server's response packets to return to the client's source port.

Key Concept

NACLs are stateless network firewalls that require both inbound rules for request traffic and outbound rules for return traffic using client ephemeral ports.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic