Examkin

Question

Difficulty: HardNetwork Security Controls (Security Groups and NACLs)

A SysOps Administrator is troubleshooting a new application deployment in a VPC. A backend microservice runs on Amazon EC2 instances in private Subnet A (CIDR block 172.16.1.0/24172.16.1.0/24). These instances must communicate with a self-managed database cluster on EC2 instances in private Subnet B (CIDR block 172.16.2.0/24172.16.2.0/24) over TCP port 2701727017.

The Security Groups are already configured to allow TCP port 2701727017 outbound from the backend Security Group, and TCP port 2701727017 inbound to the database Security Group. However, both subnets are associated with separate, custom Network Access Control Lists (NACLs) that block all traffic by default.

Which two changes must the Administrator make to the custom NACL rules to successfully enable communication between the subnets? (Select two.)

  1. In the custom NACL associated with Subnet A, add an inbound rule that allows traffic from Subnet B (172.16.2.0/24172.16.2.0/24) on TCP ports 1024−655351024-65535.Answer
  2. In the custom NACL associated with Subnet B, add an outbound rule that allows traffic to Subnet A (172.16.1.0/24172.16.1.0/24) on TCP ports 1024−655351024-65535.Answer
  3. C
    In the custom NACL associated with Subnet A, add an outbound rule that allows traffic to Subnet B (172.16.2.0/24172.16.2.0/24) on TCP ports 1024−655351024-65535.
  4. D
    In the custom NACL associated with Subnet B, add an inbound rule that allows traffic from Subnet A (172.16.1.0/24172.16.1.0/24) on TCP ports 1024−655351024-65535.
  5. E
    In the custom NACL associated with Subnet A, add an inbound rule that allows traffic from Subnet B (172.16.2.0/24172.16.2.0/24) on TCP port 2701727017.

Answer

Add an inbound rule to Subnet A's NACL allowing TCP ports 1024−655351024-65535 from Subnet B, and add an outbound rule to Subnet B's NACL allowing TCP ports 1024−655351024-65535 to Subnet A.
Because Network Access Control Lists (NACLs) are stateless, they evaluate traffic in each direction independently. When the backend microservice in Subnet A initiates a connection to the database in Subnet B on TCP port 2701727017, the client operating system assigns a random source port from the ephemeral port range (1024−655351024-65535). The return packets sent by the database back to the client will have a destination port corresponding to this ephemeral port. Therefore, to allow the response packets through the stateless NACLs, Subnet B must allow outbound traffic on the ephemeral port range to Subnet A, and Subnet A must allow inbound traffic on the ephemeral port range from Subnet B.

Step-by-Step Solution

1
Determine request and return paths for database communication.
Requests are sent from Subnet A to Subnet B on destination port 2701727017. Responses are sent from Subnet B to Subnet A on destination ephemeral ports 1024−655351024-65535.
Client applications use ephemeral ports as source ports when initiating outbound TCP connections, and return traffic is directed back to these ports.
2
Identify client-side NACL requirements for return traffic.
Subnet A's custom NACL must permit inbound TCP traffic on ports 1024−655351024-65535 from Subnet B.
Since NACLs are stateless, the inbound return traffic from the database would be blocked by default unless explicitly allowed.
3
Identify server-side NACL requirements for return traffic.
Subnet B's custom NACL must permit outbound TCP traffic on ports 1024−655351024-65535 to Subnet A.
Since NACLs are stateless, outbound response traffic from the database to the client's ephemeral ports must be explicitly allowed.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit rules for both outbound request and inbound response paths, specifically using ephemeral ports (1024−655351024-65535) for return traffic.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic