An organization hosts a multi-tier application in a VPC. A SysOps Administrator is trouble… — AWS Certified SysOps Administrator - Associate

An organization hosts a multi-tier application in a VPC. A SysOps Administrator is troubleshooting database connection timeouts between the application servers in Subnet A ( $10.0.1.0/24$ ) and a PostgreSQL database in Subnet B ( $10.0.2.0/24$ ).

The Security Groups are configured as follows:
- The application servers belong to `sg-app`, which has an outbound rule allowing TCP port $5432$ to `sg-db`.
- The database belongs to `sg-db`, which has an inbound rule allowing TCP port $5432$ from `sg-app`.

The Network ACLs (NACLs) are configured as follows:
- Subnet A NACL: Inbound rule allows all traffic from $0.0.0.0/0$ . Outbound rule allows TCP port $5432$ to $10.0.2.0/24$ .
- Subnet B NACL: Inbound rule allows TCP port $5432$ from $10.0.1.0/24$ . Outbound rule allows TCP port $5432$ to $10.0.1.0/24$ .

Which configuration change will resolve the connection timeouts while maintaining the principle of least privilege?

Modify Subnet B's NACL outbound rule to allow TCP traffic on ports $1024-65535$ to $10.0.1.0/24$ .Answer
B
Modify `sg-db` to allow outbound TCP traffic on ports $1024-65535$ to `sg-app`.
C
Modify Subnet A's NACL outbound rule to allow TCP traffic on ports $1024-65535$ to $10.0.2.0/24$ .
D
Modify Subnet B's NACL inbound rule to allow TCP traffic on ports $1024-65535$ from $10.0.1.0/24$ .

Answer

Modify Subnet B's NACL outbound rule to allow TCP traffic on ports

1024-65535

10.0.1.0/24

The correct configuration is to modify Subnet B's outbound NACL to allow TCP traffic on ports

1024-65535

targeting Subnet A's CIDR. Because NACLs are stateless, they must explicitly permit both request and response paths. When a client initiates a connection, it uses a random source port from the ephemeral port range (

1024-65535

). The database's response is sent back to this ephemeral port, requiring Subnet B's outbound NACL to allow traffic to those ports.

Step-by-Step Solution

Analyze the request path from the application servers to the database.

The application server initiates a connection on destination port

5432

from a randomly chosen ephemeral port (

1024-65535

). Subnet A's outbound NACL allows port

5432

, and Subnet B's inbound NACL allows port

5432

. The request successfully reaches the database.

To verify that the forward path is clear.

Analyze the response path from the database to the application servers.

The database sends responses back to the application server's ephemeral source port. Subnet B's outbound NACL only allows outbound traffic on destination port

5432

. Because the response target port is in the

1024-65535

range, Subnet B's outbound NACL blocks the return traffic.

To identify why the connection times out despite successful forward routing.

Formulate the correct NACL rule modification.

Update Subnet B's outbound NACL to permit TCP traffic on destination ports

1024-65535

directed to the application subnet CIDR (

10.0.1.0/24

NACLs are stateless and require explicit rules to permit response traffic.

Key Concept

Stateful vs. Stateless Network Filtering in AWS

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic