Examkin

Question

Difficulty: Very hardVPC Security Controls and Traffic Analysis

An Amazon EC2 instance with private IP address 10.0.4.1210.0.4.12 is launched in a private subnet. The instance must make outbound HTTPS requests to an external API endpoint at 203.0.113.80203.0.113.80. The SysOps Administrator has configured security groups and Network Access Control Lists (Network ACLs) for the subnet, but connection attempts from the instance to the API consistently time out. The administrator enables VPC Flow Logs and observes the following log records:

2 123456789012 eni-0a1b2c3d4e5f6g7h8 10.0.4.12 203.0.113.80 52345 443 6 1 40 1783900800 1783900860 ACCEPT OK
2 123456789012 eni-0a1b2c3d4e5f6g7h8 203.0.113.80 10.0.4.12 443 52345 6 1 40 1783900800 1783900860 REJECT OK

Which configuration adjustment will resolve this connectivity issue?

  1. Add an inbound rule to the subnet's Network ACL allowing TCP traffic from 203.0.113.80203.0.113.80 on ports 1024−655351024-65535.Answer
  2. B
    Add an outbound rule to the subnet's Network ACL allowing TCP traffic to 203.0.113.80203.0.113.80 on ports 1024−655351024-65535, since stateless Network ACLs require ephemeral ports to be allowed in the outbound direction for outbound-initiated traffic.
  3. C
    Modify the IAM policy of the SysOps Administrator to include `iam:PassRole` permissions for the flow logs delivery role, as the `REJECT` log action indicates that the logging service is unauthorized to publish records.
  4. D
    Modify the log group retention configuration in Amazon CloudWatch Logs to prevent the logs from being expired, as the `REJECT` action indicates that the target log group is rejecting log streams due to retention limit exhaustion.

Answer

Add an inbound rule to the subnet's Network ACL allowing TCP traffic from 203.0.113.80203.0.113.80 on ports 1024−655351024-65535.
The correct option is to add an inbound rule to the subnet's Network ACL allowing TCP traffic from the external API on the ephemeral port range. This is because security groups are stateful and automatically permit return traffic. Network ACLs, however, are stateless and inspect inbound and outbound traffic separately. The VPC Flow Logs show that the outbound request was accepted, but the inbound response on the ephemeral port (52345) was rejected. Thus, the stateless Network ACL blocked the return path because it lacked an inbound rule for ephemeral ports.

Step-by-Step Solution

1
Analyze the VPC Flow Log records to identify the traffic flow direction and the action taken on the packets.
The first log record shows outbound traffic from the EC2 instance (10.0.4.1210.0.4.12) to the API (203.0.113.80203.0.113.80) on destination port 443 with a status of `ACCEPT`. The second record shows inbound return traffic from the API to the EC2 instance on destination port 52345 (an ephemeral port) with a status of `REJECT`.
Identifying that the outbound request is allowed but the return traffic is blocked narrows the issue down to the return path security configurations.
2
Evaluate the stateful and stateless behaviors of the security controls applied to the EC2 instance and subnet.
Security groups are stateful; they automatically allow return traffic for any established connection. Network ACLs are stateless; they evaluate traffic in both directions independently and require explicit rules for both request and response paths.
Understanding the difference in statefulness helps determine whether the security group or Network ACL is responsible for blocking the return traffic.
3
Determine where the return packet is blocked and what rule is missing.
Since the security group automatically allows the return traffic, the block must be occurring at the stateless Network Access Control List (Network ACL). The return packet has a destination port in the ephemeral range (1024−655351024-65535). Thus, the inbound Network ACL must be updated to allow this traffic.
Adding an inbound rule to the Network ACL for the ephemeral ports will permit the return traffic to reach the instance, resolving the timeout.

Key Concept

The stateless nature of Network ACLs requires explicit rules for both request and return paths, including dynamically allocated ephemeral ports for return traffic.
Estimated Time:3m 0s
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic