Question

Difficulty: EasyNetwork Security Controls (Security Groups and NACLs)

A SysOps Administrator is configuring network access to a Windows Amazon EC2 instance located in a public subnet. The custom Security Group has no rules. The custom NACL has already been configured to allow inbound RDP traffic on TCP port 33893389 from the office IP range of 198.51.100.0/24198.51.100.0/24.

Which two configuration changes are required to allow RDP connections to be established? (Select TWO.)

  1. In the custom Security Group, add an inbound rule allowing TCP port 33893389 from 198.51.100.0/24198.51.100.0/24Answer
  2. In the custom NACL, add an outbound rule allowing TCP ports 10241024-6553565535 to 198.51.100.0/24198.51.100.0/24Answer
  3. C
    In the custom Security Group, add an outbound rule allowing TCP port 33893389 to 198.51.100.0/24198.51.100.0/24
  4. D
    In the custom NACL, add an outbound rule allowing TCP port 33893389 to 198.51.100.0/24198.51.100.0/24
  5. E
    In the custom NACL, add an inbound rule allowing TCP ports 10241024-6553565535 from 198.51.100.0/24198.51.100.0/24

Answer

To allow RDP connections, the administrator must add an inbound rule in the custom Security Group allowing TCP port 33893389 from the office IP range, and add an outbound rule in the custom NACL allowing TCP ports 10241024-6553565535 to the office IP range.
To establish an RDP connection, both the Security Group and the NACL must permit the traffic. The custom Security Group has no rules, so an inbound rule allowing TCP port 33893389 from the office IP range (198.51.100.0/24198.51.100.0/24) is required. Because Security Groups are stateful, this inbound rule automatically permits the outbound response traffic. However, NACLs are stateless. Although the inbound NACL rule for TCP port 33893389 is already configured, an outbound NACL rule is required to allow the response traffic. The response traffic will target the client's ephemeral ports (TCP 10241024-6553565535), so the outbound NACL rule must allow TCP ports 10241024-6553565535 to the office IP range.

Step-by-Step Solution

1
Determine the necessary change for the custom Security Group.
Add an inbound rule allowing TCP port 33893389 from 198.51.100.0/24198.51.100.0/24.
Since the Security Group currently has no rules, inbound traffic on port 33893389 must be allowed. Because Security Groups are stateful, the return traffic is automatically permitted, so no outbound Security Group rule is required.
2
Determine the necessary change for the stateless custom NACL.
Add an outbound rule allowing TCP ports 10241024-6553565535 to 198.51.100.0/24198.51.100.0/24.
NACLs are stateless and require explicit rules for both traffic directions. Since the inbound rule on port 33893389 is already configured, the administrator must add an outbound rule to allow the return traffic back to the client's ephemeral ports (10241024-6553565535).

Key Concept

Understanding the difference between stateful Security Groups and stateless Network Access Control Lists (NACLs) when configuring inbound and outbound traffic rules.
Rate this question