Examkin

Question

Difficulty: EasyNetwork Security Controls (Security Groups and NACLs)

An Amazon EC2 instance in a private subnet needs to download security patches from an external repository over HTTPS (TCP port 443). The subnet's custom network access control list (NACL) has a rule that allows outbound TCP traffic on port 443 to any destination. However, the connection attempts are timing out. Which modification to the custom NACL will allow the EC2 instance to successfully receive the patches?

  1. A
    Configure an inbound rule permitting TCP traffic on port 443 from the repository's IP address.
  2. B
    Adjust the security group to permit inbound TCP traffic on ports 1024-65535 from the repository's IP address.
  3. Configure an inbound rule permitting TCP traffic on ports 1024-65535 from the repository's IP address.Answer
  4. D
    Configure an outbound rule permitting TCP traffic on ports 1024-65535 to the repository's IP address.

Answer

Configure an inbound rule permitting TCP traffic on ports 1024-65535 from the repository's IP address.
The correct configuration is to configure an inbound rule permitting TCP traffic on ports 1024-65535. Network Access Control Lists (NACLs) are stateless, meaning that allowing outbound traffic does not automatically allow the corresponding return traffic. When the EC2 instance initiates a connection to the external repository on port 443, the repository sends the response back to the instance's ephemeral ports, which typically range from 1024 to 65535. Therefore, an inbound rule covering these ephemeral ports is required to allow the response traffic through the NACL.

Step-by-Step Solution

1
Analyze the traffic flow and the security components involved.
The EC2 instance is initiating an outbound connection over HTTPS (destination port 443) through a stateless network access control list (NACL).
Evaluating both Security Groups and NACLs for inbound and outbound traffic determines where the connection is being blocked.
2
Apply the stateless rule behavior of Network Access Control Lists (NACLs).
NACLs are stateless, meaning they do not automatically allow response traffic. Therefore, an outbound connection requires a corresponding inbound rule to allow the return traffic.
Understanding the stateless nature of NACLs is necessary to realize that allowing outbound traffic alone is insufficient for communication.
3
Identify the destination ports for the return traffic.
When a client initiates a connection, it uses a random ephemeral port (typically in the range 1024-65535) as the source port. The return traffic from the server will target this ephemeral port range on the client.
To write the correct inbound rule, you must specify the range of ports the client is listening on for the response.

Key Concept

NACLs are stateless firewalls that control traffic at the subnet level, requiring explicit rules for both inbound and outbound traffic, including ephemeral ports for return traffic.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic