Examkin

Question

Difficulty: MediumNetwork Security Controls (Security Groups and NACLs)

A company has deployed a fleet of backend processing instances in a private subnet (192.168.2.0/24192.168.2.0/24) that must query an external license validation API at 198.51.100.85/32198.51.100.85/32 over HTTPS. The outbound traffic is routed through a NAT Gateway in the public subnet (192.168.1.0/24192.168.1.0/24). The Network Access Control List (NACL) associated with the private subnet currently has default deny rules for custom traffic. Which two changes are required in the private subnet's NACL to enable successful end-to-end communication with the license validation server?

  1. An outbound rule to allow TCP port 443443 traffic destined for the external validation server IP address.Answer
  2. An inbound rule to allow TCP traffic from the external validation server IP address on ephemeral ports 10241024 to 6553565535.Answer
  3. C
    An inbound rule to allow TCP port 443443 traffic originating from the external validation server IP address.
  4. D
    An outbound rule to allow TCP traffic on ephemeral ports 10241024 to 6553565535 destined for the external validation server IP address.
  5. E
    An inbound rule to allow TCP port 8080 traffic originating from the NAT Gateway IP address.

Answer

The changes required are: adding an outbound rule to allow TCP port 443 traffic to the external validation server, and adding an inbound rule to allow TCP traffic from the external validation server on ephemeral ports.
Because Network Access Control Lists (NACLs) are stateless, both the request (outbound TCP port 443) and response (inbound TCP ephemeral ports 1024-65535) must be explicitly allowed. Since the backend instances initiate the HTTPS connection to the external validation server, the outbound path requires a rule allowing TCP port 443 traffic to the destination. For the return traffic, the external server will respond from its port 443 to the ephemeral ports allocated by the client instances in the private subnet. Therefore, the inbound path requires a rule allowing TCP traffic from the validation server's IP address to the ephemeral port range (1024 to 65535) of the private subnet.

Step-by-Step Solution

1
Analyze the traffic flow requirements.
The private instances initiate an outbound connection to the external validation server over HTTPS (port 443).
To determine which ports and directions are involved in the request phase.
2
Identify the stateless behavior of Network Access Control Lists (NACLs).
Both outbound request traffic and inbound response traffic must be explicitly allowed.
Unlike stateful Security Groups, NACLs do not automatically track connection state.
3
Determine the port configuration for the return traffic.
The response traffic from the external server will target the ephemeral port range of the client instances (1024 to 65535).
To ensure the inbound NACL rule allows the response traffic back to the originating instances.

Key Concept

The stateless nature of Network Access Control Lists (NACLs) requires rules for both request and response paths, including allowing inbound traffic on ephemeral ports for outbound connections.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic