Examkin

Question

Difficulty: HardVPC Security Controls and Traffic Analysis

A SysOps Administrator is investigating a connection timeout issue between an application server in subnet A (10.0.1.0/2410.0.1.0/24) and a database server in subnet B (10.0.2.0/2410.0.2.0/24). Both subnets are within the same VPC. Security groups have been verified as correct. The administrator reviews the following VPC Flow Log records for the network interface of the database server:

2 123456789012 eni-0123456789abcdef0 10.0.1.50 10.0.2.10 49152 3306 6 20 1040 1620123456 1620123516 ACCEPT OK
2 123456789012 eni-0123456789abcdef0 10.0.2.10 10.0.1.50 3306 49152 6 20 1040 1620123456 1620123516 REJECT OK

Which of the following actions must the administrator perform to resolve this connection issue? (Select TWO.)

  1. Add an outbound rule to the database subnet's Network ACL (NACL) to allow outbound TCP traffic on ports 1024−655351024-65535 to the application subnet CIDR block (10.0.1.0/2410.0.1.0/24).Answer
  2. Add an inbound rule to the application subnet's Network ACL (NACL) to allow inbound TCP traffic on ports 1024−655351024-65535 from the database subnet CIDR block (10.0.2.0/2410.0.2.0/24).Answer
  3. C
    Add an outbound rule to the database server's Security Group to allow outbound TCP traffic on ports 1024−655351024-65535 to the application server (10.0.1.5010.0.1.50).
  4. D
    Configure an IAM role with the `sts:AssumeRole` action for the VPC Flow Logs service and attach it to the database EC2 instance.
  5. E
    Add a route to the database subnet's route table that targets the Internet Gateway (IGW) for the destination 10.0.1.5010.0.1.50.

Answer

To resolve the connection issue, the administrator must add an outbound rule to the database subnet's Network ACL (NACL) allowing outbound TCP traffic on ports 1024−655351024-65535 to the application subnet, and add an inbound rule to the application subnet's Network ACL (NACL) allowing inbound TCP traffic on ports 1024−655351024-65535 from the database subnet.
The VPC Flow Logs reveal that inbound traffic from the application server (source IP 10.0.1.5010.0.1.50 on source port 4915249152) to the database server (destination IP 10.0.2.1010.0.2.10 on database port 33063306) is accepted. However, the outbound response from the database server (source IP 10.0.2.1010.0.2.10 on source port 33063306) back to the application server (destination IP 10.0.1.5010.0.1.50 on destination port 4915249152) is rejected. Since Security Groups are stateful, any accepted inbound request will automatically allow the outbound response. The rejection must therefore be occurring at a stateless boundary, which is the Network ACL (NACL). To fix this, an outbound rule must be added to the database subnet's NACL to allow traffic to the ephemeral ports (1024−655351024-65535) of the application subnet. Additionally, since NACLs are stateless at both boundaries, the application subnet's NACL must also contain an inbound rule allowing the response traffic on the ephemeral port range from the database subnet.

Step-by-Step Solution

1
Analyze the VPC Flow Logs to determine the state of the network traffic.
The flow logs show that the inbound request from the application server (10.0.1.5010.0.1.50 port 4915249152) to the database (10.0.2.1010.0.2.10 port 33063306) is accepted, but the outbound response (database source port 33063306 to application destination port 4915249152) is rejected.
This isolates the failure to the outbound path of the response traffic.
2
Identify which security control is causing the outbound rejection.
Since Security Groups are stateful, they automatically allow outbound response traffic for accepted inbound connections. Therefore, the rejection is caused by the stateless Network ACL (NACL) filtering.
This helps determine that the stateless NACL needs modification rather than the stateful Security Group.
3
Update the stateless Network ACLs to allow the response traffic on ephemeral ports.
The database subnet's NACL must allow outbound traffic on ephemeral ports (1024−655351024-65535) to the application subnet. Concurrently, the application subnet's NACL must allow inbound traffic on those same ephemeral ports from the database subnet.
NACLs are stateless and must be explicitly configured in both directions at both subnet boundaries to allow traffic to flow.

Key Concept

Stateless network access control list (NACL) evaluation versus stateful security group evaluation in Amazon VPC, and interpreting custom flow logs.
Estimated Time:3m 0s
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic