An administrator deploys web servers in a subnet of a new VPC (10.0.0.0/16). The servers m… — AWS Certified SysOps Administrator - Associate

An administrator deploys web servers in a subnet of a new VPC ( $10.0.0.0/16$ ). The servers must host a public website on port $80$ and retrieve updates from a public third-party repository. The instances have public IPv4 addresses. Currently, users on the internet cannot access the website, and the web servers cannot reach the external repository.

The administrator verifies the following configuration details:
- The security group associated with the web servers allows inbound port $80$ from $0.0.0.0/0$ and all outbound traffic.
- The custom Network Access Control List (NACL) associated with the subnet has inbound rules allowing port $80$ from $0.0.0.0/0$ and outbound rules allowing all traffic to $0.0.0.0/0$ .
- The subnet's route table contains a local route for $10.0.0.0/16$ but no other routes. An Internet Gateway is attached to the VPC.

Which combination of actions will resolve the connectivity issues? (Select TWO.)

Add a route to the subnet's route table for $0.0.0.0/0$ targeting the Internet Gateway.Answer
Add an inbound rule to the custom NACL allowing traffic from $0.0.0.0/0$ on ephemeral ports ( $1024$ - $65535$ ).Answer
C
Add an outbound rule to the security group allowing traffic on ephemeral ports ( $1024$ - $65535$ ) to $0.0.0.0/0$ .
D
Create a Gateway VPC Endpoint for the external repository and associate it with the subnet's route table.
E
Add a route to the subnet's route table for $0.0.0.0/0$ targeting the Virtual Private Gateway.

Answer

Add a route to the subnet's route table for

0.0.0.0/0

targeting the Internet Gateway, and add an inbound rule to the custom NACL allowing traffic from

0.0.0.0/0

on ephemeral ports (

1024

65535

To resolve the issues, the administrator must address two distinct bottlenecks: routing and stateless firewall rules. First, a route for

0.0.0.0/0

targeting the Internet Gateway is required in the subnet's route table to establish a path to the internet. Second, because NACLs are stateless, return traffic for connections initiated by the web servers (such as updates from the repository) will target the web servers' ephemeral ports (

1024

65535

). Thus, an inbound rule allowing traffic on ephemeral ports is required to permit this response traffic.

Step-by-Step Solution

Analyze the routing table configuration.

The routing table only contains a local route (

10.0.0.0/16

), meaning the instances have no way to route traffic out to the internet.

Public subnet communication requires a default route (

0.0.0.0/0

) pointing to the Internet Gateway (IGW).

Analyze the stateless firewall (NACL) rules for outbound connections initiated by the web servers.

When the web servers initiate outbound connections to the external repository on ports

80

443

, the return packets from the repository target the client's temporary ephemeral ports (

1024

65535

). Since the custom NACL only allows inbound traffic on port

80

, these return packets are blocked.

Network ACLs are stateless and require explicit rules for both request and response traffic in both directions.

Evaluate the proposed solutions against security group and routing requirements.

Adding the

0.0.0.0/0

route to the IGW enables outbound routing. Adding the inbound NACL rule for ephemeral ports (

1024

65535

) enables the return traffic for connections initiated by the servers. Security Group modifications are unnecessary due to statefulness.

Both routing and stateless firewall constraints must be resolved to restore complete internet connectivity.

Key Concept

SysOps administrators must configure both routing tables and stateless network access control lists (NACLs) to enable two-way internet communication in a VPC subnet.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic