Examkin

Question

Difficulty: MediumVPC Security Controls and Traffic Analysis

A SysOps Administrator is troubleshooting a connectivity issue where external users cannot access a web application running on an Amazon EC2 instance. The instance is located in a subnet that is intended to be public. The administrator verifies that the web server is active and listening locally on TCP port 8080. However, when reviewing the VPC Flow Logs for the instance's elastic network interface (ENI), the administrator finds that there are no flow log records (either `ACCEPT` or `REJECT`) corresponding to external client IP addresses on port 8080.

What is the most likely cause of this issue?

  1. A
    The Network ACL associated with the subnet does not allow inbound TCP traffic on port 8080.
  2. The subnet's route table does not contain a route pointing to the Internet Gateway.Answer
  3. C
    The security group associated with the EC2 instance does not allow inbound TCP traffic on port 8080.
  4. D
    The Application Load Balancer target group health check path is misconfigured.

Answer

The subnet's route table does not contain a route pointing to the Internet Gateway.
The correct answer is that the subnet's route table does not contain a route pointing to the Internet Gateway. VPC Flow Logs capture traffic at the network interface (ENI) level. If traffic from the internet cannot be routed to the subnet because of a missing route to the Internet Gateway, the packets never reach the ENI. Consequently, no flow log entries (neither ACCEPT nor REJECT) are generated for the client IPs. For a subnet to be public and accessible from the internet, its route table must have a route for 0.0.0.0/00.0.0.0/0 pointing to the Internet Gateway.

Step-by-Step Solution

1
Analyze the symptom of having no flow log records (neither ACCEPT nor REJECT) on port 8080 for external IP addresses.
The absence of any flow log records indicates that the packets are not reaching the Elastic Network Interface (ENI) at all.
VPC Flow Logs capture traffic at the network interface level. If a packet reaches the interface and is blocked by a security group or NACL, it generates a REJECT record.
2
Evaluate the role of the Internet Gateway (IGW) and the subnet's route table.
Without a route pointing to the Internet Gateway, external traffic cannot be routed to the subnet.
The default route (0.0.0.0/00.0.0.0/0) targeting the IGW is required for a subnet to be public and reachable from the internet.
3
Correlate the findings with the provided options.
The missing route to the Internet Gateway is the only configuration issue that prevents packets from reaching the subnet, explaining the complete lack of flow log records.
Other security controls like security groups and Network ACLs would drop the packet at the interface or subnet boundary, producing REJECT log entries.

Key Concept

VPC routing requirements for public subnets and the behavior of VPC Flow Logs at the ENI level.
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic