Examkin

Question

Difficulty: MediumNetwork Security Controls (Security Groups and NACLs)

A company runs a microservices application where a payment processing service in Subnet Alpha (10.200.1.0/2410.200.1.0/24) must make API calls to a verification service in Subnet Beta (10.200.2.0/2410.200.2.0/24) on TCP port 84438443. A custom Network Access Control List (NACL) is associated with Subnet Alpha, while Subnet Beta uses the default VPC NACL. Security groups for both services are configured to allow the required traffic. However, connection attempts from Subnet Alpha to Subnet Beta on port 84438443 are timing out.

Which configuration change must be made to the Subnet Alpha NACL to enable successful communication?

  1. Add an outbound rule to allow TCP port 8443 to Subnet Beta, and add an inbound rule to allow TCP ports 1024-65535 from Subnet Beta.Answer
  2. B
    Add an outbound rule to allow TCP port 8443 to Subnet Beta. No inbound rule is required in the Subnet Alpha NACL because security groups are stateful and track the connection.
  3. C
    Add an outbound rule to allow TCP port 8443 to Subnet Beta, and add an inbound rule to allow TCP port 8443 from Subnet Beta.
  4. D
    Add an inbound rule to allow TCP port 8443 from Subnet Beta, and add an outbound rule to allow TCP ports 1024-65535 to Subnet Beta.

Answer

Add an outbound rule to allow TCP port 8443 to Subnet Beta, and add an inbound rule to allow TCP ports 1024-65535 from Subnet Beta.
Network Access Control Lists (NACLs) are stateless. To allow the payment processing service in Subnet Alpha to establish a connection with the verification service in Subnet Beta on port 8443, Subnet Alpha's NACL must permit outbound TCP traffic to Subnet Beta on port 8443 (for the request) and permit inbound TCP traffic from Subnet Beta on ports 1024-65535 (for the response to the client's ephemeral port).

Step-by-Step Solution

1
Analyze the traffic flow requirements from the source (Subnet Alpha) to the destination (Subnet Beta).
The initial request travels outbound from Subnet Alpha to Subnet Beta on TCP port 8443. The return traffic travels inbound from Subnet Beta back to Subnet Alpha on a client-allocated ephemeral port in the range 1024-65535.
Since Network Access Control Lists (NACLs) are stateless, separate rules must be evaluated for both outbound request traffic and inbound response traffic.
2
Formulate the outbound NACL rule for Subnet Alpha.
Create an outbound rule with a destination CIDR of Subnet Beta (10.200.2.0/24), protocol TCP, and port 8443 set to ALLOW.
This allows the client application in Subnet Alpha to initiate connections to the verification service.
3
Formulate the inbound NACL rule for Subnet Alpha to handle the return path.
Create an inbound rule with a source CIDR of Subnet Beta (10.200.2.0/24), protocol TCP, and port range 1024-65535 set to ALLOW.
This allows the response from the verification service to reach the client's temporary ephemeral port, completing the TCP handshake and session.

Key Concept

Network Access Control Lists (NACLs) are stateless network filters that require explicit rules for both the request and response traffic paths, including the allocation of ephemeral ports for client connections.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic