Examkin

Question

Difficulty: MediumNetwork Security Controls (Security Groups and NACLs)

A SysOps Administrator is troubleshooting network connectivity between two private subnets in a VPC. Application servers are located in Subnet A (172.16.1.0/24172.16.1.0/24) and need to perform secure directory lookups on an LDAP server located in Subnet B (172.16.2.0/24172.16.2.0/24) over TCP port 636636.

Both subnets are associated with custom Network Access Control Lists (NACLs). The security groups associated with the application servers and the LDAP server are already configured to allow the required traffic. However, the directory lookups are currently failing.

Which two changes should the SysOps Administrator make to the NACLs to resolve this issue? (Select two.)

  1. In the Subnet A NACL, add an inbound rule that allows TCP traffic from Subnet B (172.16.2.0/24172.16.2.0/24) on destination ports 1024−655351024-65535.Answer
  2. In the Subnet B NACL, add an outbound rule that allows TCP traffic to Subnet A (172.16.1.0/24172.16.1.0/24) on destination ports 1024−655351024-65535.Answer
  3. C
    In the Subnet B NACL, add an outbound rule that allows TCP traffic to Subnet A (172.16.1.0/24172.16.1.0/24) on destination port 636636.
  4. D
    In the Subnet A NACL, add an inbound rule that allows TCP traffic from Subnet B (172.16.2.0/24172.16.2.0/24) on destination port 636636.
  5. E
    In the security group associated with the LDAP server, add an outbound rule that allows TCP traffic to Subnet A (172.16.1.0/24172.16.1.0/24) on destination ports 1024−655351024-65535.

Answer

In the Subnet A NACL, add an inbound rule that allows TCP traffic from Subnet B on destination ports 1024−655351024-65535, and in the Subnet B NACL, add an outbound rule that allows TCP traffic to Subnet A on destination ports 1024−655351024-65535.
Because Network Access Control Lists (NACLs) are stateless, separate rules must be defined for request and response traffic. When a client in Subnet A initiates an LDAP request to Subnet B on TCP port 636636, the client uses a random port in the ephemeral range (1024−655351024-65535) as its source port. The LDAP server's response will therefore be sent from source port 636636 to destination ports 1024−655351024-65535. To allow this return traffic, the Subnet B NACL must have an outbound rule allowing TCP traffic to the Subnet A CIDR range on destination ports 1024−655351024-65535, and the Subnet A NACL must have an inbound rule allowing TCP traffic from the Subnet B CIDR range on destination ports 1024−655351024-65535.

Step-by-Step Solution

1
Analyze the flow of LDAP traffic and the stateless nature of NACLs.
Identify that the LDAP query request flows from Subnet A to Subnet B on destination TCP port 636636. The response flows from Subnet B back to Subnet A on destination ephemeral ports (1024−655351024-65535). Since NACLs are stateless, rules for both the request and response traffic must be explicitly allowed.
To determine which network paths and ports are currently blocked by the stateless custom NACLs.
2
Identify the required return path rules in both NACLs.
The response traffic leaving Subnet B needs an outbound rule in Subnet B's NACL targeting Subnet A's CIDR (172.16.1.0/24172.16.1.0/24) on destination ports 1024−655351024-65535. The response traffic entering Subnet A needs an inbound rule in Subnet A's NACL allowing source IP range Subnet B (172.16.2.0/24172.16.2.0/24) on destination ports 1024−655351024-65535.
To specify the correct stateless rules that must be added to the NACLs.
3
Evaluate the stateful behavior of security groups in the context of this scenario.
Verify that since security groups are stateful, no additional outbound rule is needed on the LDAP server's security group, as the return response is tracked and allowed automatically.
To confirm that security group modifications are not needed and to rule out security group-based distractors.

Key Concept

Because Network Access Control Lists (NACLs) are stateless, return traffic to client ephemeral ports (1024−655351024-65535) must be explicitly permitted in both inbound and outbound rules.
Estimated Time:1m 30s
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic