An organization uses an AWS Transit Gateway to connect its VPC (10.100.0.0/16) to an on-pr… — AWS Certified SysOps Administrator - Associate

An organization uses an AWS Transit Gateway to connect its VPC ( $10.100.0.0/16$ ) to an on-premises network ( $192.168.10.0/24$ ) over an AWS Site-to-Site VPN. An application server running on an Amazon EC2 instance ( $10.100.1.55$ ) in a private subnet ( $10.100.1.0/24$ ) must connect to an on-premises database ( $192.168.10.200$ ) on TCP port $3306$ .

The EC2 instance's security group allows all outbound traffic to $0.0.0.0/0$ and has no inbound rules. The private subnet's route table has a default route ( $0.0.0.0/0$ ) targeting a NAT Gateway, and a local route for $10.100.0.0/16$ . The private subnet's Network Access Control List (NACL) allows outbound traffic to $0.0.0.0/0$ on all ports, but the inbound NACL only allows traffic from the local VPC range ( $10.100.0.0/16$ ).

The EC2 instance cannot establish a connection to the on-premises database.

Which combination of actions must a SysOps administrator take to resolve this connectivity issue? (Select TWO.)

Add a route for $192.168.10.0/24$ in the private subnet's route table with the Transit Gateway as the target.Answer
Add an inbound rule to the private subnet's NACL that allows traffic from $192.168.10.0/24$ on ephemeral ports ( $1024-65535$ ).Answer
C
Add an inbound rule to the private subnet's NACL that allows traffic from $192.168.10.0/24$ on TCP port $3306$ .
D
Modify the private subnet's route table to change the target of the default route ( $0.0.0.0/0$ ) to the Transit Gateway.
E
Create a Gateway VPC Endpoint for the database and associate it with the private subnet's route table.

Answer

To resolve the connectivity issue, the administrator must add a route for the on-premises network (

192.168.10.0/24

) targeting the Transit Gateway in the private subnet's route table, and add an inbound rule to the private subnet's NACL to allow return traffic from the on-premises network (

192.168.10.0/24

) on ephemeral ports (

1024-65535

To resolve the connectivity issue, two changes are required. First, a route for the on-premises network range (

192.168.10.0/24

) must be added to the private subnet's route table pointing to the Transit Gateway. This ensures that outbound packets destined for the database are routed to the Transit Gateway instead of matching the default route to the NAT Gateway. Second, since Network Access Control Lists (NACLs) are stateless, an inbound rule must be added to the private subnet's NACL to allow traffic from the on-premises database subnet (

192.168.10.0/24

) on ephemeral ports (

1024-65535

). This allows the return packets of the TCP connection back to the client.

Step-by-Step Solution

Analyze the routing configuration of the private subnet.

The current route table only contains a local route and a default route targeting a NAT Gateway. Packets destined for the database IP (

192.168.10.200

) will match the default route (

0.0.0.0/0

) and be sent to the NAT Gateway rather than the Transit Gateway.

To identify why the database traffic is not reaching the Transit Gateway VPN attachment.

Add a specific route to the private subnet's route table.

A route for

192.168.10.0/24

pointing to the Transit Gateway is added, directing database traffic correctly.

To override the default route for the on-premises destination and send it to the Transit Gateway.

Analyze the private subnet's stateless NACL rules.

The inbound NACL only allows traffic from the local VPC (

10.100.0.0/16

), meaning return traffic from the database (

192.168.10.0/24

) will be blocked.

To determine why return packets are being dropped at the VPC boundary despite the security group being stateful.

Add an inbound rule to the NACL allowing ephemeral ports.

An inbound rule is added to allow traffic from

192.168.10.0/24

on ports

1024-65535

Because NACLs are stateless, return packets destined for the EC2 instance's dynamic client ports must be explicitly allowed.

Key Concept

Troubleshooting routing tables and stateless NACL ephemeral ports in hybrid networking scenarios.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic