Examkin

Question

Difficulty: EasyNetwork Security Controls (Security Groups and NACLs)

A SysOps Administrator is hosting a web application on an Amazon EC2 instance in a public subnet. To allow public HTTP access, the administrator creates a custom Network Access Control List (NACL) associated with the subnet and adds an inbound rule allowing TCP traffic on port 80 from 0.0.0.0/0. The security group associated with the EC2 instance already allows all inbound and outbound traffic. However, external web clients are still unable to load the website. Which configuration change must the administrator make to allow clients to establish HTTP connections?

  1. Add an outbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 to 0.0.0.0/0.Answer
  2. B
    Add an outbound rule to the custom NACL allowing TCP traffic on port 80 to 0.0.0.0/0.
  3. C
    Add an outbound rule to the EC2 instance's security group allowing TCP traffic on ports 1024-65535 to 0.0.0.0/0.
  4. D
    Add an inbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 from 0.0.0.0/0.

Answer

Add an outbound rule to the custom NACL allowing TCP traffic on ports 1024-65535 to 0.0.0.0/0.
The correct option is the one stating that an outbound rule must be added to the custom NACL to allow TCP traffic on ports 1024-65535. Network Access Control Lists (NACLs) operate at the subnet level and are stateless, meaning they do not track connection states. Therefore, outbound response traffic must be explicitly permitted. When client browsers send requests to port 80, they expect the return traffic on a randomly allocated ephemeral port (1024-65535). Adding this rule allows the response traffic to flow back to the clients.

Step-by-Step Solution

1
Identify the statefulness of the network security controls in use.
Security groups are stateful, but NACLs are stateless.
Because NACLs are stateless, return traffic is not automatically tracked or allowed; it must be permitted explicitly by outbound rules.
2
Determine the destination port range for the outbound return traffic from the web server back to the clients.
The return traffic from the web server goes to the client's ephemeral ports (1024-65535).
When a client initiates a connection to port 80, its local OS assigns a random high-numbered port (ephemeral port) for the response.
3
Select the correct rule to add to the stateless NACL configuration.
Add an outbound rule allowing TCP on ports 1024-65535 to 0.0.0.0/0.
This allows the return traffic to pass through the subnet boundary to the client.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit outbound rules for ephemeral port ranges to allow response traffic back to clients.
Estimated Time:1m 0s
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic