Examkin

Question

Difficulty: MediumNetwork Security Controls (Security Groups and NACLs)

An organization hosts a self-hosted Git repository server on an Amazon EC2 instance in Subnet B (10.10.2.0/2410.10.2.0/24). Developer workspaces run on Amazon EC2 instances in Subnet A (10.10.1.0/2410.10.1.0/24). A SysOps Administrator configures custom Network Access Control Lists (NACLs) to allow developers in Subnet A to clone repositories from Subnet B over SSH (TCP port 2222).

The custom NACL for Subnet A has the following rule configuration:
- Outbound Rule 100100: Allow TCP port 2222 to destination 10.10.2.0/2410.10.2.0/24

The custom NACL for Subnet B has the following rule configuration:
- Inbound Rule 100100: Allow TCP port 2222 from source 10.10.1.0/2410.10.1.0/24
- Outbound Rule 100100: Allow TCP ports 1024−655351024-65535 to destination 10.10.1.0/2410.10.1.0/24

Developers report that they cannot connect to the Git repository server. Which rule addition will resolve this network connection issue?

  1. Add an inbound rule to Subnet A's NACL allowing TCP ports 1024−655351024-65535 from source 10.10.2.0/2410.10.2.0/24Answer
  2. B
    Add an inbound rule to Subnet A's NACL allowing TCP port 2222 from source 10.10.2.0/2410.10.2.0/24
  3. C
    Add an outbound rule to Subnet A's NACL allowing TCP ports 1024−655351024-65535 to destination 10.10.2.0/2410.10.2.0/24
  4. D
    Add an inbound rule to Subnet B's NACL allowing TCP ports 1024−655351024-65535 from source 10.10.1.0/2410.10.1.0/24

Answer

Add an inbound rule to Subnet A's NACL allowing TCP ports 1024-65535 from source 10.10.2.0/24
Because Network Access Control Lists (NACLs) are stateless, a rule must be explicitly created to allow return traffic. When a client in Subnet A establishes an SSH connection (TCP port 22) to a server in Subnet B, the client allocates an ephemeral port (typically in the range 1024-65535) for the source port of the connection. The server responds from its port 22 back to the client's ephemeral port. Therefore, Subnet A's NACL must allow inbound traffic on TCP ports 1024-65535 from the Subnet B source CIDR.

Step-by-Step Solution

1
Analyze the traffic flow direction and port numbers for the SSH connection.
The client in Subnet A initiates the connection to Subnet B on port 22, allocating a random ephemeral port (1024-65535) as the source port.
Understanding TCP client-server port allocations is necessary to configure stateless firewalls.
2
Evaluate the existing NACL rules for Subnet A and Subnet B.
Subnet A allows outbound port 22. Subnet B allows inbound port 22 and outbound ephemeral ports. Subnet A's inbound path for response packets (from Subnet B port 22 to Subnet A ephemeral ports) is blocked by the default deny rule.
Since NACLs are stateless, return traffic must be explicitly permitted in both directions.
3
Determine the missing rule to allow the return traffic.
Subnet A requires an inbound rule to permit TCP traffic on ports 1024-65535 from source CIDR 10.10.2.0/24.
This completes the return path of the connection at the Subnet A boundary.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit rules for both the request and the return traffic paths, including the allocation of client ephemeral ports.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic