Examkin

Question

Difficulty: Very hardNetwork Security Controls (Security Groups and NACLs)

An enterprise application deployment contains EC2 instances in an application subnet (10.10.1.0/24) that must connect to a Microsoft SQL Server database cluster in a database subnet (10.10.2.0/24) on TCP port 1433. The default Network Access Control Lists (NACLs) have been replaced with custom NACLs that deny all traffic by default.

The current configurations are:
- The application subnet's custom NACL has an outbound rule allowing TCP port 1433 to 10.10.2.0/24, and an inbound rule allowing TCP ports 1024-65535 from 10.10.2.0/24.
- The database subnet's custom NACL has an inbound rule allowing TCP port 1433 from 10.10.1.0/24, and an outbound rule allowing TCP port 1433 to 10.10.1.0/24.
- The security groups associated with the instances allow the necessary stateful database traffic.

Although the security groups are correctly configured, database connections from the application subnet fail. Which of the following changes to the custom NACL configurations will resolve this connectivity issue?

  1. In the database subnet's NACL, modify the outbound rule to allow TCP port range 1024-65535 to destination 10.10.1.0/24.Answer
  2. B
    In the database subnet's NACL, modify the inbound rule to allow TCP port range 1024-65535 from source 10.10.1.0/24.
  3. C
    In the application subnet's NACL, modify the inbound rule to allow TCP port 1433 from source 10.10.2.0/24.
  4. D
    In the database Security Group, add an outbound rule allowing TCP port range 1024-65535 to the application Security Group.

Answer

In the database subnet's NACL, modify the outbound rule to allow TCP port range 1024-65535 to destination 10.10.1.0/24.
The correct option is the one that recommends modifying the database subnet's NACL outbound rule to allow TCP port range 1024-65535. Because NACLs are stateless, return traffic must be explicitly allowed. When the application client initiates a connection to the SQL Server database on port 1433, the client uses an ephemeral port (1024-65535) as its source port. The database's response will therefore have a destination port within the ephemeral port range. The database subnet's outbound NACL rule currently only allows TCP port 1433, which blocks the response traffic.

Step-by-Step Solution

1
Analyze the request path from the application subnet to the database subnet.
The application subnet's NACL outbound rule allows port 1433. The database subnet's NACL inbound rule allows port 1433. Security groups allow port 1433. The request path is clear.
Identify where in the connection lifecycle the failure occurs.
2
Analyze the response path from the database subnet to the application subnet.
The database response source port is 1433, and its destination port is the client's ephemeral port (1024-65535). Security groups are stateful and automatically allow response traffic, but NACLs are stateless and must be explicitly configured.
Since SGs are stateful and NACLs are stateless, we must check if both NACLs allow the response traffic.
3
Evaluate the database subnet's outbound NACL rule against the response packet.
The current database subnet outbound NACL rule allows TCP port 1433. However, the destination port of the response packet is ephemeral (1024-65535). Because NACL rules filter on destination ports, the response packet is denied by the default rule.
Stateless firewalls like NACLs examine the destination port of outbound packets. For return traffic, this is the client's ephemeral port range.
4
Formulate the correct configuration change to permit the response.
Modify the database subnet's outbound NACL rule to allow TCP ports 1024-65535 to destination 10.10.1.0/24.
This allows the stateless NACL to permit outgoing response packets destined for the client's ephemeral ports.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit rules for both request and response traffic, where the response traffic is destined for ephemeral ports.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic