Examkin

Question

Difficulty: Very hardNetwork Security Controls (Security Groups and NACLs)

An organization runs a fleet of Amazon EC2 instances in a private VPC subnet (10.0.2.0/2410.0.2.0/24) that must initiate outbound connections to a third-party payment gateway on the internet on TCP port 84438443. The client application on the EC2 instances uses ephemeral ports (1024−655351024-65535) as source ports. Outbound traffic is routed through a NAT Gateway located in a public subnet (10.0.1.0/2410.0.1.0/24). Both the private subnet's Network Access Control List (NACL) and the EC2 instances' security group are custom and currently deny all inbound and outbound traffic. Which combination of rule configurations will successfully allow the EC2 instances to establish connections and receive responses from the payment gateway? (Select TWO.)

  1. In the custom security group, add an outbound rule that allows TCP traffic on port 84438443 to 0.0.0.0/00.0.0.0/0.Answer
  2. In the private subnet's custom NACL, add an outbound rule that allows TCP traffic on port 84438443 to 0.0.0.0/00.0.0.0/0, and an inbound rule that allows TCP traffic on port range 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.Answer
  3. C
    In the private subnet's custom NACL, add an outbound rule that allows TCP traffic on port 84438443 to 0.0.0.0/00.0.0.0/0, and an inbound rule that allows TCP traffic on port 84438443 from 0.0.0.0/00.0.0.0/0.
  4. D
    In the custom security group, add an outbound rule that allows TCP traffic on port 84438443 to the private IP address of the NAT Gateway.
  5. E
    In the private subnet's custom NACL, add an inbound rule that allows TCP traffic on port 84438443 from 0.0.0.0/00.0.0.0/0, and an outbound rule that allows TCP traffic on port range 1024−655351024-65535 to 0.0.0.0/00.0.0.0/0.

Answer

In the custom security group, add an outbound rule that allows TCP traffic on port 84438443 to 0.0.0.0/00.0.0.0/0; and in the private subnet's custom NACL, add an outbound rule that allows TCP traffic on port 84438443 to 0.0.0.0/00.0.0.0/0, and an inbound rule that allows TCP traffic on port range 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.
The correct configuration requires allowing outbound TCP port 84438443 in the security group to 0.0.0.0/00.0.0.0/0, as security groups are stateful and track the destination IP of the packet. In addition, because NACLs are stateless, the private subnet's NACL must explicitly allow the outbound request on port 84438443 and the inbound response on the ephemeral port range (1024−655351024-65535).

Step-by-Step Solution

1
Analyze the Security Group requirements for the outbound payment gateway traffic.
Since Security Groups are stateful, only an outbound rule is needed. The destination must be the payment gateway's IP address (or 0.0.0.0/00.0.0.0/0), not the next-hop NAT Gateway's private IP, because security groups evaluate the packet's destination IP. No inbound rule is required because response traffic is automatically allowed.
To configure the security group correctly, we must allow port 84438443 outbound and rely on stateful packet tracking for the return traffic.
2
Analyze the Network Access Control List (NACL) requirements for the private subnet.
NACLs are stateless, meaning rules must be configured for both the outbound request and the inbound response. The outbound rule must allow destination port 84438443. The inbound rule must allow the return traffic to the client's ephemeral port range (1024−655351024-65535).
Without the inbound NACL rule for the ephemeral port range, the return response from the payment gateway will be blocked at the subnet boundary.

Key Concept

Stateful vs. Stateless network controls in AWS VPC (Security Groups vs. NACLs) and their handling of ephemeral ports.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic