Examkin

Question

Difficulty: HardNetwork Security Controls (Security Groups and NACLs)

An application tier runs on Amazon EC2 instances in Subnet A (10.0.1.0/2410.0.1.0/24). A PostgreSQL database runs on an Amazon EC2 instance in Subnet B (10.0.2.0/2410.0.2.0/24). Both subnets are in the same VPC. The Security Group associated with the database instance allows inbound TCP traffic on port 54325432 from the security group of the application tier. Subnet A is associated with the default Network Access Control List (NACL), which allows all inbound and outbound traffic. Subnet B is associated with a custom NACL that contains only the default deny rules. Currently, the application instances are unable to connect to the database. Which of the following rules must be added to the Subnet B NACL to allow successful database connections from the application tier? (Select TWO.)

  1. An inbound rule that allows TCP traffic on port 54325432 from source 10.0.1.0/2410.0.1.0/24Answer
  2. An outbound rule that allows TCP traffic on ports 1024−655351024-65535 to destination 10.0.1.0/2410.0.1.0/24Answer
  3. C
    An outbound rule that allows TCP traffic on port 54325432 to destination 10.0.1.0/2410.0.1.0/24
  4. D
    An inbound rule that allows TCP traffic on ports 1024−655351024-65535 from source 10.0.1.0/2410.0.1.0/24
  5. E
    An outbound rule that allows TCP traffic on ports 1024−655351024-65535 to destination 10.0.2.0/2410.0.2.0/24

Answer

An inbound rule that allows TCP traffic on port 54325432 from source 10.0.1.0/2410.0.1.0/24, and an outbound rule that allows TCP traffic on ports 1024−655351024-65535 to destination 10.0.1.0/2410.0.1.0/24.
For a successful TCP connection to the PostgreSQL database, the Subnet B Network ACL must allow both the inbound connection request and the outbound response. The inbound rule must permit TCP traffic on the database port (54325432) from the application tier's subnet (10.0.1.0/2410.0.1.0/24). Because Network ACLs are stateless, the outbound response is not automatically allowed; a corresponding outbound rule must be created. This outbound rule must allow TCP traffic to destination 10.0.1.0/2410.0.1.0/24 on ports 1024−655351024-65535, which represents the ephemeral ports allocated by the client operating systems for the connection.

Step-by-Step Solution

1
Analyze the request flow path.
The application tier initiates a database request from Subnet A (10.0.1.0/2410.0.1.0/24) to the database in Subnet B (10.0.2.0/2410.0.2.0/24) on destination port 54325432.
An inbound rule on Subnet B's NACL must permit TCP port 54325432 from Subnet A's CIDR block to allow the connection request to reach the database instance.
2
Analyze the response flow path and identify client port allocation.
The client OS in Subnet A allocates a random source port from the ephemeral range (1024−655351024-65535) for the connection request. The database returns traffic to this destination port.
Network ACLs are stateless. Therefore, the response traffic from Subnet B to Subnet A is not tracked or automatically allowed, requiring an outbound rule.
3
Configure the outbound NACL rule for Subnet B.
An outbound rule allowing TCP traffic on ports 1024−655351024-65535 to destination 10.0.1.0/2410.0.1.0/24 is required.
This outbound rule ensures the database server can respond to the ephemeral ports of the application instances in Subnet A.

Key Concept

Stateless Network ACL configuration requires explicitly allowing both request and response traffic, accounting for target service ports inbound and ephemeral client ports outbound.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic