An EC2 instance is located in private Subnet A (CIDR 10.0.1.0/24) and needs to download so… — AWS Certified SysOps Administrator - Associate

An EC2 instance is located in private Subnet A (CIDR $10.0.1.0/24$ ) and needs to download software updates from an external repository at IP address $203.0.113.50$ over HTTPS (port $443$ ). The instance routes all outbound internet traffic through a NAT Gateway located in public Subnet B (CIDR $10.0.2.0/24$ ). The EC2 instance is associated with a Security Group that allows all outbound traffic but has no inbound rules. Subnet A is associated with a Network Access Control List (NACL-A) that has an inbound rule (Rule $100$ ) allowing TCP port $443$ from $0.0.0.0/0$ and an outbound rule (Rule $100$ ) allowing TCP port $443$ to $0.0.0.0/0$ . Subnet B is associated with a Network Access Control List (NACL-B) that allows all inbound and outbound traffic. Despite this configuration, the EC2 instance fails to connect to the external repository. Which action will resolve this connectivity issue?

A
Add an inbound rule to the EC2 instance's Security Group that allows TCP traffic on ports $1024$ - $65535$ from $203.0.113.50/32$ .
B
Configure a VPC Gateway Endpoint for the external patch repository and associate it with the route table of Subnet A.
Add an inbound rule to NACL-A that allows TCP traffic on ports $1024$ - $65535$ from $0.0.0.0/0$ .Answer
D
Remove the route to the NAT Gateway in Subnet A's route table and add a route targeting an Internet Gateway to allow direct outbound communication.

Answer

Add an inbound rule to NACL-A that allows TCP traffic on ports

1024

65535

from

0.0.0.0/0

Network Access Control Lists (NACLs) are stateless, which means they do not track connection states and require explicit inbound and outbound rules for communication to succeed. When the EC2 instance initiates an outbound connection to the external repository on TCP port

443

, the repository sends the response packets back to the instance's ephemeral ports, which are within the range

1024

65535

. Since NACL-A only has an inbound rule allowing port

443

(which would only match incoming requests to a web server hosted on the instance), the response traffic to the ephemeral ports is blocked by the default deny rule. Adding an inbound rule to NACL-A for TCP ports

1024

65535

from

0.0.0.0/0

allows the response traffic to reach the EC2 instance.

Step-by-Step Solution

Analyze the statefulness of the security components in the traffic path.

The Security Group is stateful and already permits all outbound traffic, meaning it automatically allows response traffic. However, the NACL (NACL-A) is stateless, so outbound requests and inbound responses must both be explicitly permitted by rules.

Troubleshooting network security controls requires distinguishing between the stateful nature of Security Groups and the stateless nature of NACLs.

Determine the destination port of the return traffic from the external repository.

The client initiates a connection to port

443

. The response traffic sent back by the repository targets the client's randomly allocated ephemeral port (range

1024

65535

Standard TCP client-server communications use ephemeral ports on the client side to receive return packets.

Evaluate the existing inbound rules in NACL-A.

NACL-A's inbound Rule

100

only allows traffic targeting destination port

443

. It does not cover the ephemeral ports (

1024

65535

) where the return traffic is destined, causing the return packets to be dropped by the default deny rule.

Identifying the specific blocked port in the stateless firewall explains why the TCP handshake cannot complete.

Identify the configuration change needed to permit the return traffic.

Adding an inbound rule to NACL-A allowing TCP traffic on ports

1024

65535

from

0.0.0.0/0

will allow the return traffic to pass through the stateless firewall to the private EC2 instance.

This configuration correctly accounts for the return path of stateless network connections.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit rules for return traffic using ephemeral ports, whereas stateful Security Groups automatically allow return traffic.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic