Examkin

Question

Difficulty: MediumNetwork Security Controls (Security Groups and NACLs)

A SysOps Administrator is configuring connectivity between an application server hosted on an Amazon EC2 instance in Subnet A (10.50.1.0/2410.50.1.0/24) and an Oracle database instance in Subnet B (10.50.2.0/2410.50.2.0/24) inside the same VPC. The database listens on TCP port 15211521. Security groups are already configured correctly to allow this traffic.

Subnet A is associated with NACL-A, which has the following custom rules:
* Inbound: Allow TCP port 15211521 from Subnet B (10.50.2.0/2410.50.2.0/24)
* Outbound: Allow TCP port 15211521 to Subnet B (10.50.2.0/2410.50.2.0/24)

Subnet B is associated with NACL-B, which has the following custom rules:
* Inbound: Allow TCP port 15211521 from Subnet A (10.50.1.0/2410.50.1.0/24)
* Outbound: Allow TCP port 15211521 to Subnet A (10.50.1.0/2410.50.1.0/24)

All other traffic in both NACLs is denied. The application server is unable to connect to the database.

Which of the following actions should the SysOps Administrator take to resolve this connectivity issue?

  1. A
    Add an outbound rule to NACL-A allowing outbound TCP traffic on ports 1024−655351024-65535 to Subnet B, and add an inbound rule to NACL-B allowing inbound TCP traffic on ports 1024−655351024-65535 from Subnet A.
  2. B
    No changes to the NACLs are required because Security Groups are stateful and will automatically allow the return traffic.
  3. Add an inbound rule to NACL-A allowing inbound TCP traffic on ports 1024−655351024-65535 from Subnet B, and add an outbound rule to NACL-B allowing outbound TCP traffic on ports 1024−655351024-65535 to Subnet A.Answer
  4. D
    Add an inbound rule to NACL-B allowing inbound TCP traffic on ports 1024−655351024-65535 from Subnet A, and add an outbound rule to NACL-A allowing outbound TCP traffic on ports 1024−655351024-65535 to Subnet B.

Answer

Add an inbound rule to NACL-A allowing inbound TCP traffic on ports 1024−655351024-65535 from Subnet B, and add an outbound rule to NACL-B allowing outbound TCP traffic on ports 1024−655351024-65535 to Subnet A.
The correct option adds the necessary ephemeral port rules to the stateless NACLs. Since Network Access Control Lists (NACLs) are stateless, they do not track connection state, meaning separate rules are required to allow both request and response traffic. The application server initiates the connection on TCP port 15211521 using an ephemeral source port (range 1024−655351024-65535). While the request path is fully allowed by current rules, the response path (from the database to the application server's ephemeral port) is blocked. To allow this return traffic, NACL-B must allow outbound TCP traffic on ports 1024−655351024-65535 to Subnet A, and NACL-A must allow inbound TCP traffic on ports 1024−655351024-65535 from Subnet B.

Step-by-Step Solution

1
Analyze the connection flow from the initiator (Application Server in Subnet A) to the receiver (Database in Subnet B).
The application server initiates a TCP request. The destination IP is the database IP, destination port is 15211521. The source IP is the application server IP, and the source port is a dynamically allocated ephemeral port from the range 1024−655351024-65535.
This establishes the source and destination port parameters for both the outbound request and the return response.
2
Evaluate the NACL rules for the request path.
NACL-A allows outbound TCP port 15211521 to Subnet B. NACL-B allows inbound TCP port 15211521 from Subnet A. The request path is successfully permitted.
Ensure that the initial connection request is not blocked by either NACL.
3
Evaluate the NACL rules for the return path.
The return traffic from the database (Subnet B) to the application server (Subnet A) has a source port of 15211521 and a destination port in the ephemeral range 1024−655351024-65535. NACL-B outbound only allows destination port 15211521, and NACL-A inbound only allows destination port 15211521.
NACLs are stateless, meaning return traffic must be explicitly allowed on the destination ports.
4
Determine the necessary rules to permit the return path.
NACL-B must allow outbound TCP traffic to Subnet A on destination ports 1024−655351024-65535. NACL-A must allow inbound TCP traffic from Subnet B on destination ports 1024−655351024-65535.
This allows the response packet to reach the application server, completing the TCP handshake.

Key Concept

Network Access Control Lists (NACLs) are stateless packet filters, meaning return traffic must be explicitly allowed. For client-initiated connections, return traffic is sent to ephemeral ports (1024−655351024-65535).
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic