Examkin

Question

Difficulty: HardVPC Security Controls and Traffic Analysis

An Amazon EC2 instance with the private IP address 10.0.1.1510.0.1.15 is launched in a private subnet of a VPC. The instance is configured to download software updates from a public repository at 198.51.100.50198.51.100.50 via HTTPS. The security group associated with the EC2 instance allows all outbound traffic and has no inbound rules. The instance is unable to complete the download. A SysOps Administrator enables VPC Flow Logs for the subnet and observes the following log entries:

versionsrcaddrdstaddrsrcportdstportprotocolpacketsbytesstartendactionlog-status
210.0.1.15198.51.100.50491524436540017188400001718840060ACCEPTOK
2198.51.100.5010.0.1.15443491526540017188400001718840060REJECTOK

Which of the following is the most likely root cause of this connection failure?

  1. The Network Access Control List (NACL) associated with the subnet lacks an inbound rule to allow traffic from the repository to the ephemeral ports (10241024-6553565535) of the EC2 instance.Answer
  2. B
    The security group associated with the EC2 instance does not allow inbound traffic on TCP port 443, which is required to establish the SSL/TLS handshake for the HTTPS connection.
  3. C
    The route table associated with the private subnet is missing a route targeting the Internet Gateway, preventing the return packets from reaching the EC2 instance.
  4. D
    The VPC Flow Logs role is missing the iam:PassRole permission, which prevents the security group from dynamically evaluating return traffic for active TCP sessions.

Answer

The Network Access Control List (NACL) associated with the subnet lacks an inbound rule to allow traffic from the repository to the ephemeral ports (10241024-6553565535) of the EC2 instance.
The correct answer is that the Network Access Control List (NACL) lacks an inbound rule to allow traffic to the ephemeral ports. Network ACLs are stateless, meaning return traffic must be explicitly allowed. In this scenario, the outbound request from port 49152 to port 443 is accepted, but the inbound response from port 443 to port 49152 is rejected. Opening the ephemeral port range (10241024-6553565535) inbound on the NACL resolves this issue.

Step-by-Step Solution

1
Analyze the VPC Flow Logs provided in the scenario.
The first entry shows outbound traffic from the instance (10.0.1.1510.0.1.15) to the repository (198.51.100.50198.51.100.50) on TCP port 443 with a status of ACCEPT. The second entry shows the return traffic from the repository to the instance on port 49152 with a status of REJECT.
This establishes that the initial connection request was successfully sent and allowed out, but the response was blocked on its way back.
2
Evaluate the stateful security group rules.
Since the security group allows all outbound traffic, and security groups are stateful, the return traffic on port 49152 is automatically permitted by the security group.
This rules out security group inbound rules as the source of the rejection.
3
Evaluate the stateless Network ACL (NACL) rules.
Because Network ACLs are stateless, they must be explicitly configured with inbound rules to allow response traffic back to the subnet's ephemeral port range (10241024-6553565535).
The flow log action of REJECT indicates that a stateless firewall rule (the NACL) is explicitly blocking the inbound packet.

Key Concept

Statelessness of Network ACLs vs. Stateful Security Groups
Estimated Time:2m 0s
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic