A SysOps Administrator is configuring a custom Network Access Control List (NACL) for a pr… — AWS Certified SysOps Administrator - Associate

A SysOps Administrator is configuring a custom Network Access Control List (NACL) for a private subnet that hosts a fleet of Amazon EC2 instances. These instances must download security patches from an external repository over HTTPS (TCP port 443) via a NAT gateway. The security group associated with the instances permits all outbound traffic.

The private subnet's custom NACL has the following rules:
- Outbound: Rule 100 allows TCP port 443 to $0.0.0.0/0$ .
- Inbound: Rule 100 allows TCP port 443 from $0.0.0.0/0$ .
All other traffic is denied by the default rules. The instances are currently unable to download the patches.

Which configuration change will resolve this connectivity issue?

Add an inbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 from $0.0.0.0/0$ .Answer
B
Add an inbound rule to the security group allowing TCP traffic on ports 1024-65535 from $0.0.0.0/0$ .
C
Add an outbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 to $0.0.0.0/0$ .
D
Modify the private subnet's route table to route outbound traffic ( $0.0.0.0/0$ ) directly to the Internet Gateway.

Answer

Add an inbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 from the internet.

Because Network Access Control Lists (NACLs) are stateless, return traffic must be explicitly allowed. When an EC2 instance initiates a connection to an external repository over HTTPS (TCP port 443), the return traffic from the repository is sent to the instance's ephemeral port range (1024-65535). Therefore, an inbound NACL rule must be configured to allow TCP traffic on ports 1024-65535.

Step-by-Step Solution

Identify the nature of the network security controls in use.

The security group is stateful, while the Network Access Control List (NACL) is stateless.

Since the security group is stateful, it automatically permits the response traffic for any established outbound connection. However, because the NACL is stateless, we must configure rules to allow both the outbound request and the inbound response.

Analyze the port requirements for the outbound request and inbound response.

The outbound connection goes to destination port 443 (HTTPS) from an ephemeral source port (1024-65535). The inbound response comes from source port 443 to the destination ephemeral port (1024-65535) of the EC2 instance.

We must verify that both paths are permitted by the NACL rules.

Review the existing NACL rules and identify the bottleneck.

The outbound NACL rule allows TCP port 443, which permits the outbound request. However, the inbound NACL rule only allows TCP port 443, which blocks the inbound response since its destination port is an ephemeral port (1024-65535).

Adding an inbound NACL rule for TCP ports 1024-65535 allows the response traffic to reach the instances.

Key Concept

Statelessness of Network Access Control Lists (NACLs) and the requirement of ephemeral ports for return traffic.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic