Examkin

Question

Difficulty: HardVPC Flow Logs and Network Monitoring

A SysOps Administrator is troubleshooting network connectivity between an Amazon EC2 instance in a public subnet and an external database. The EC2 instance is attempting to connect to the database at IP address 203.0.113.50 on TCP port 5432. The connection attempts are failing with a timeout.

The administrator enables VPC Flow Logs for the EC2 instance's elastic network interface (ENI). The flow logs capture the following records:

text
2 123456789012 eni-0123456789abcdef0 10.0.1.15 203.0.113.50 49152 5432 6 1 40 1620000000 1620000060 ACCEPT OK
2 123456789012 eni-0123456789abcdef0 203.0.113.50 10.0.1.15 5432 49152 6 1 40 1620000000 1620000060 REJECT OK

Which two statements explain this behavior and identify the correct configuration changes required to resolve this connectivity issue? (Select two.)

  1. The Network Access Control List (NACL) associated with the subnet is blocking the inbound response traffic on the ephemeral port.Answer
  2. The Network Access Control List (NACL) associated with the subnet must be updated to allow inbound traffic on TCP ports 1024-65535 from 203.0.113.50.Answer
  3. C
    The Security Group associated with the EC2 instance is blocking the response traffic and must be updated to allow inbound traffic on TCP port 49152 from 203.0.113.50.
  4. D
    The Security Group associated with the EC2 instance must be updated to allow inbound traffic on TCP port 5432 from 203.0.113.50.
  5. E
    The subnet's route table is missing a route targeting the Internet Gateway (IGW), which is preventing the outbound connection from leaving the VPC.

Answer

The Network Access Control List (NACL) associated with the subnet is blocking the inbound response traffic on the ephemeral port, and this NACL must be updated to allow inbound traffic on TCP ports 1024-65535 from the database IP address.
The VPC Flow Logs demonstrate that the outbound packet from the EC2 instance to the database on port 5432 was successfully accepted, but the corresponding inbound response from the database to the EC2 instance's ephemeral port (49152) was rejected. Security groups are stateful, meaning they track connection states and automatically allow return traffic for allowed outbound connections. Therefore, the security group is not the component rejecting the packet. Network Access Control Lists (NACLs), however, are stateless and require explicit rules for both outbound and inbound traffic. To resolve this connectivity issue, the subnet's NACL must be modified to include an inbound rule allowing return traffic from the database's IP address on the ephemeral port range (1024-65535).

Step-by-Step Solution

1
Analyze the direction, ports, and action of the VPC Flow Log records.
The first record shows an outbound packet (source 10.0.1.15 to destination 203.0.113.50 on port 5432) was accepted. The second record shows an inbound packet (source 203.0.113.50 on port 5432 to destination 10.0.1.15 on port 49152) was rejected.
VPC Flow Logs record the source and destination IPs and ports, as well as the action (ACCEPT or REJECT) taken by security groups and NACLs.
2
Evaluate the stateful nature of Security Groups against the log results.
Since the outbound packet was accepted, any Security Group that allowed the outbound connection would automatically permit the inbound response on the ephemeral port.
Security Groups are stateful; they track connections and allow return traffic automatically without checking inbound rules.
3
Evaluate the stateless nature of Network ACLs against the log results.
Because the outbound packet was accepted but the inbound response on the client's ephemeral port (49152) was rejected, the stateless Network ACL must be blocking the return traffic.
Network ACLs are stateless, meaning return traffic is not automatically tracked and must be explicitly allowed by inbound rules.
4
Identify the correct configuration change to restore traffic.
Add an inbound rule to the Network ACL associated with the subnet that allows TCP traffic on ephemeral ports (1024-65535) from the database's IP address (203.0.113.50).
This allows the response packets from the database to bypass the NACL restriction and reach the EC2 instance.

Key Concept

Stateful vs. Stateless Network Controls in AWS VPCs
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic