A company is hosting a centralized monitoring server on an Amazon EC2 instance in Subnet A… — AWS Certified SysOps Administrator - Associate

A company is hosting a centralized monitoring server on an Amazon EC2 instance in Subnet A ( $172.31.1.0/24$ ). This server is configured to scrape metrics from production application servers located in Subnet B ( $172.31.2.0/24$ ) on TCP port 9100.

The custom Network Access Control List (NACL) for Subnet A has the following rules:
* Inbound: Allow TCP traffic on ports $1024-65535$ from Subnet B ( $172.31.2.0/24$ )
* Outbound: Allow TCP traffic on port 9100 to Subnet B ( $172.31.2.0/24$ )

The custom NACL for Subnet B has the following rules:
* Inbound: Allow TCP traffic on port 9100 from Subnet A ( $172.31.1.0/24$ )
* Outbound: Allow TCP traffic on port 9100 to Subnet A ( $172.31.1.0/24$ )

The Security Groups associated with the EC2 instances are configured correctly to allow traffic on port 9100. However, the monitoring server cannot establish a connection to scrape metrics.

Which modification to the Subnet B NACL rules is required to resolve this connectivity issue?

Modify the outbound rule for Subnet B to allow TCP traffic on ports 1024-65535 to Subnet A.Answer
B
Modify the outbound rule for Subnet B to allow TCP traffic on port 9100 to Subnet A and enable stateful tracking in the NACL settings.
C
Modify the inbound rule for Subnet B to allow TCP traffic on ports 1024-65535 from Subnet A.
D
Remove the outbound rule in Subnet B entirely, as the stateful nature of the security groups will automatically permit the response traffic.

Answer

Modify the outbound rule for Subnet B to allow TCP traffic on ports 1024-65535 to Subnet A.

The correct answer is to modify the outbound rule for Subnet B to allow TCP traffic on ports 1024-65535 to Subnet A. Because Network Access Control Lists (NACLs) are stateless, they evaluate inbound and outbound traffic independently. When the monitoring server in Subnet A initiates a connection to port 9100 on the application servers in Subnet B, the monitoring server uses a dynamically allocated ephemeral port (within the range 1024-65535) as the source port. The application server responds from port 9100 to that ephemeral destination port. Therefore, the outbound NACL rules for Subnet B must allow traffic on ports 1024-65535 to Subnet A in order for the response to pass through.

Step-by-Step Solution

Analyze the direction of the connection initiation.

The connection is initiated by the monitoring server in Subnet A (IP range

172.31.1.0/24

) and targets port 9100 on the application servers in Subnet B (IP range

172.31.2.0/24

Understanding the source and destination is critical to diagnosing NACL issues.

Determine the ports used for the outbound request and response.

The request goes from Subnet A (source: ephemeral port

1024-65535

) to Subnet B (destination: port 9100). The response goes from Subnet B (source: port 9100) back to Subnet A (destination: ephemeral port

1024-65535

NACLs are stateless, meaning both request and response traffic must be explicitly allowed by separate rules.

Evaluate the current configuration of Subnet B's NACL rules.

Subnet B's inbound rules allow port 9100 from Subnet A, which is correct. However, Subnet B's outbound rules only allow port 9100 to Subnet A. This blocks the response traffic because it is destined for the client's ephemeral port range (

1024-65535

) instead of port 9100.

Identifying where the traffic is blocked points to the correct configuration change.

Formulate the required correction for Subnet B's NACL.

Change the outbound rule of Subnet B to allow TCP traffic on ports

1024-65535

targeting Subnet A.

This allows the application servers to send the metrics response back to the client's ephemeral ports.

Key Concept

NACLs are stateless, which requires outbound rules to explicitly permit return traffic to the client's ephemeral port range (typically 1024-65535).

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic