Examkin

Question

Difficulty: EasyNetwork Security Controls (Security Groups and NACLs)

An EC2 instance is hosting a web server in a VPC subnet. The SysOps Administrator needs to configure the subnet's Network Access Control List (NACL) to allow incoming HTTP requests on port 80 from the internet (0.0.0.0/0). Which two rules must the administrator add to the custom NACL to allow this traffic?

  1. An inbound rule that allows TCP port 80 from source 0.0.0.0/0Answer
  2. An outbound rule that allows TCP ports 1024-65535 to destination 0.0.0.0/0Answer
  3. C
    An outbound rule that allows TCP port 80 to destination 0.0.0.0/0
  4. D
    An inbound rule that allows TCP ports 1024-65535 from source 0.0.0.0/0
  5. E
    An outbound rule that allows TCP port 443 to destination 0.0.0.0/0

Answer

The correct configurations are: an inbound rule allowing TCP port 80 from source 0.0.0.0/0 and an outbound rule allowing TCP ports 1024-65535 to destination 0.0.0.0/0.
The correct configuration requires allowing inbound TCP port 80 from source 0.0.0.0/0 to accept incoming HTTP requests, and allowing outbound TCP ports 1024-65535 to destination 0.0.0.0/0 to permit the return traffic. Because NACLs are stateless, separate rules are needed for both inbound request and outbound response paths, and response traffic is directed to the client's ephemeral ports.

Step-by-Step Solution

1
Identify the protocol and port of the incoming requests.
HTTP traffic uses TCP port 80.
The client initiates an inbound request on the web server's listening port.
2
Configure the inbound rule on the NACL.
Allow TCP port 80 from source 0.0.0.0/0.
This allows the external client requests to reach the web server.
3
Determine the return path port range and protocol.
Return traffic targets the client's source ephemeral ports, typically in the range of 1024-65535.
Because NACLs are stateless, they do not automatically track connection state and require explicit outbound rules for the response.
4
Configure the outbound rule on the NACL.
Allow TCP ports 1024-65535 to destination 0.0.0.0/0.
This allows the web server's responses to reach back to the clients.

Key Concept

Statelessness of Network Access Control Lists (NACLs) and ephemeral port requirements
Estimated Time:45s
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic