An organization hosts a web application on Amazon EC2 instances in Subnet A (172.16.1.0/24… — AWS Certified SysOps Administrator - Associate

An organization hosts a web application on Amazon EC2 instances in Subnet A ( $172.16.1.0/24$ ). The application uses an Amazon ElastiCache for Redis cluster in Subnet B ( $172.16.2.0/24$ ) to cache session data.

Subnet A and Subnet B are associated with custom Network Access Control Lists (NACLs): NACL-A and NACL-B, respectively.

The EC2 instances and the Redis cluster are configured with security groups that allow traffic on TCP port $6379$ . However, the application instances are experiencing connection timeouts when trying to write to the Redis cluster.

A SysOps Administrator reviews the custom NACL configurations:

Which configuration change must the administrator make to resolve this connection issue?

A
In NACL-A, modify the inbound rule to allow TCP traffic on port range $6379$ from source $172.16.2.0/24$ .
B
In NACL-A, modify the outbound rule to allow TCP traffic on port range $1024$ - $65535$ to destination $172.16.2.0/24$ .
In NACL-B, modify the outbound rule to allow TCP traffic on port range $1024$ - $65535$ to destination $172.16.1.0/24$ .Answer
D
In NACL-B, modify the inbound rule to allow TCP traffic on port range $1024$ - $65535$ from source $172.16.1.0/24$ .

Answer

Modify the outbound rule of NACL-B (associated with Subnet B) to allow TCP traffic on port range

1024

65535

to destination

172.16.1.0/24

The correct configuration change is to modify the outbound rule of NACL-B (associated with Subnet B) to allow TCP traffic on port range

1024

65535

to destination

172.16.1.0/24

. Network ACLs are stateless, which means response traffic must be explicitly allowed. Since application instances in Subnet A initiate the connection to the Redis port

6379

from random ephemeral ports (

1024

65535

), the return traffic sent by the Redis cluster from its local port

6379

must be allowed to travel back to the client's destination ephemeral ports in Subnet A. Configuring NACL-B's outbound rule to only allow destination port

6379

blocks this return traffic.

Step-by-Step Solution

Identify the client and server roles in the network communication flow.

EC2 instances in Subnet A (

172.16.1.0/24

) act as clients, and the Redis cluster in Subnet B (

172.16.2.0/24

) acts as the server.

This establishes the direction of initial requests and return traffic.

Trace the destination and source ports for both inbound and outbound directions.

Outbound requests go from Subnet A ephemeral ports (

1024

65535

) to Subnet B port

6379

. Inbound responses go from Subnet B port

6379

to Subnet A ephemeral ports (

1024

65535

Network ACLs are stateless, meaning separate rules are required for both directions.

Evaluate the current NACL rules against the traced traffic flow.

NACL-B's outbound rule incorrectly limits return traffic to destination port

6379

, blocking the return traffic heading to the client's ephemeral ports in Subnet A.

This identifies the exact rule preventing successful network transmission.

Determine the correct modification to resolve the block.

Modify NACL-B's outbound rule to allow TCP traffic on port range

1024

65535

to Subnet A.

This permits the stateless response packets to reach the client instances.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit rules for both request and response traffic, necessitating the inclusion of client ephemeral ports for return traffic.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic