Examkin

Question

Difficulty: MediumVPC Security Controls and Traffic Analysis

A SysOps Administrator is troubleshooting a connectivity issue where Amazon EC2 instances in a private subnet are unable to download package updates from an external repository over HTTPS (port 443). The subnet's route table contains a route to a NAT Gateway, and the instances' security groups are configured to allow all outbound TCP port 443 traffic.

VPC Flow Logs reveal the following record:
`2 123456789012 eni-0a1b2c3d4e5f6g7h8 198.51.100.55 10.0.1.15 443 51234 6 10 400 1781222400 1781222460 REJECT OK`

Which of the following actions will resolve this issue?

  1. A
    Add a route targeting an Internet Gateway (IGW) in the private subnet's route table to allow the EC2 instances to communicate directly with the external repository.
  2. B
    Modify the CloudWatch Logs retention settings for the VPC Flow Logs log group to prevent log expiration from terminating the active connections.
  3. Add an inbound rule to the subnet's Network ACL (NACL) to allow TCP traffic on destination ports 1024–65535 from the external repository.Answer
  4. D
    Configure the EC2 instances' IAM role to include the iam:PassRole permission to authorize the instances to bypass subnet-level traffic restrictions.

Answer

Add an inbound rule to the subnet's Network ACL (NACL) to allow TCP traffic on destination ports 1024–65535 from the external repository.
The correct action is to add an inbound rule to the subnet's Network ACL (NACL) to allow TCP traffic on destination ports 1024–65535 from the external repository. Because NACLs are stateless, they do not automatically track connection state. Response traffic returning from the repository (source port 443) back to the client EC2 instance's ephemeral port (destination port 51234) must be explicitly allowed by an inbound NACL rule. The flow logs show a REJECT action for inbound traffic from the repository on destination port 51234, confirming that the stateless NACL is blocking the return traffic.

Step-by-Step Solution

1
Analyze the VPC Flow Log record to determine the source, destination, ports, and action.
The flow log shows inbound TCP traffic from the external repository (198.51.100.55:443) destined for the EC2 instance (10.0.1.15:51234) is being REJECTED.
This establishes that outbound request traffic succeeded but return traffic is blocked.
2
Differentiate between stateful and stateless security controls in the VPC path.
Security groups are stateful and automatically permit return traffic, so the issue is not caused by the security group. Network ACLs (NACLs) are stateless and evaluate inbound and outbound traffic separately.
This isolates the root cause to a missing inbound rule in the subnet's NACL.
3
Identify the destination port of the rejected return traffic to create the correct NACL rule.
The destination port for the return traffic is 51234, which is in the standard TCP ephemeral port range (1024-65535). Adding an inbound rule to allow this range resolves the block.
This determines the exact configuration change needed to restore connectivity.

Key Concept

VPC Security Controls and Traffic Analysis
Estimated Time:1m 30s
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic