Examkin

Question

Difficulty: MediumNetwork Security Controls (Security Groups and NACLs)

An application tier is deployed on Amazon EC2 instances in a private subnet with CIDR block 10.0.1.0/2410.0.1.0/24. The instances must download software updates from an external repository over HTTPS (port 443443). The private subnet's route table contains a route pointing 0.0.0.0/00.0.0.0/0 to a NAT Gateway located in a public subnet. The Security Group attached to the instances allows outbound TCP traffic on port 443443 to 0.0.0.0/00.0.0.0/0, with no inbound rules. The subnet's Network Access Control List (NACL) has an inbound rule allowing TCP traffic on port 443443 from 0.0.0.0/00.0.0.0/0, and an outbound rule allowing TCP traffic on port 443443 to 0.0.0.0/00.0.0.0/0. However, the instances are unable to establish a connection to the external repository. Which configuration change will resolve this connectivity issue?

  1. Add an inbound rule to the NACL allowing TCP traffic on ports 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.Answer
  2. B
    Add an inbound rule to the Security Group allowing TCP traffic on ports 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.
  3. C
    Add an outbound rule to the NACL allowing TCP traffic on ports 1024−655351024-65535 to 0.0.0.0/00.0.0.0/0.
  4. D
    Update the private subnet's route table to route 0.0.0.0/00.0.0.0/0 directly to the Internet Gateway instead of the NAT Gateway.

Answer

Add an inbound rule to the NACL allowing TCP traffic on ports 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.
The correct option is to add an inbound rule to the NACL allowing TCP traffic on ports 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0. Amazon VPC Network Access Control Lists (NACLs) are stateless. This means that response traffic to allowed outbound requests is not automatically permitted; an explicit inbound rule must allow the traffic back in. When an EC2 instance initiates a connection to an external repository on port 443443, the response traffic is sent from the repository's port 443443 to an ephemeral port (1024−655351024-65535) on the EC2 instance. Therefore, the inbound NACL must allow traffic on these ephemeral ports.

Step-by-Step Solution

1
Analyze the request path from the private EC2 instances to the external repository.
The Security Group allows outbound port 443443 to 0.0.0.0/00.0.0.0/0. The outbound NACL allows port 443443 to 0.0.0.0/00.0.0.0/0. The route table correctly routes internet-bound traffic to the NAT Gateway. The outbound request successfully leaves the VPC.
To ensure the outbound connection is initiated and reaches the destination.
2
Analyze the return traffic path from the external repository back to the private EC2 instances.
The repository responds from port 443443 to the ephemeral ports (1024−655351024-65535) on the EC2 instances. The Security Group is stateful, so it automatically allows the return traffic. The NACL is stateless, so it requires an explicit inbound rule for this return traffic.
Since NACLs do not track connection state, return traffic must be evaluated against inbound rules.
3
Identify the missing rule in the NACL configurations.
The current inbound NACL rule only allows port 443443, but the incoming return packets have destination ports in the ephemeral range (1024−655351024-65535). An inbound rule allowing ports 1024−655351024-65535 is required.
To allow stateless inbound return traffic to reach the instances.

Key Concept

NACLs are stateless and require explicit rules for both inbound request traffic and outbound return traffic (or vice versa), including the ephemeral port range.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic