A SysOps Administrator is configuring network access to a Windows Amazon EC2 instance located in a public subnet. The custom Security Group has no rules. The custom NACL has already been configured to allow inbound RDP traffic on TCP port from the office IP range of .
Which two configuration changes are required to allow RDP connections to be established? (Select TWO.)
- In the custom Security Group, add an inbound rule allowing TCP port from Answer
- In the custom NACL, add an outbound rule allowing TCP ports - to Answer
- CIn the custom Security Group, add an outbound rule allowing TCP port to
- DIn the custom NACL, add an outbound rule allowing TCP port to
- EIn the custom NACL, add an inbound rule allowing TCP ports - from
Answer
To allow RDP connections, the administrator must add an inbound rule in the custom Security Group allowing TCP port from the office IP range, and add an outbound rule in the custom NACL allowing TCP ports - to the office IP range.
To establish an RDP connection, both the Security Group and the NACL must permit the traffic. The custom Security Group has no rules, so an inbound rule allowing TCP port from the office IP range () is required. Because Security Groups are stateful, this inbound rule automatically permits the outbound response traffic. However, NACLs are stateless. Although the inbound NACL rule for TCP port is already configured, an outbound NACL rule is required to allow the response traffic. The response traffic will target the client's ephemeral ports (TCP -), so the outbound NACL rule must allow TCP ports - to the office IP range.
Step-by-Step Solution
Key Concept
Understanding the difference between stateful Security Groups and stateless Network Access Control Lists (NACLs) when configuring inbound and outbound traffic rules.