Examkin

Question

Difficulty: HardNetwork Security Controls (Security Groups and NACLs)

A SysOps Administrator is setting up an administrative logging server on an Amazon EC2 instance in a public subnet (10.0.1.0/2410.0.1.0/24) to receive remote log streams over TCP port 514 from a legacy on-premises logging agent (192.168.1.50/32192.168.1.50/32). The public subnet is associated with a custom Network Access Control List (NACL), and the EC2 instance is associated with a custom Security Group. The custom Security Group has an inbound rule allowing TCP port 514 from 192.168.1.50/32192.168.1.50/32 and an outbound rule allowing all traffic. However, logs are not reaching the server, and connection attempts are timing out. Which two updates to the custom NACL rules must the administrator perform to resolve this connectivity issue?

  1. Inbound rule: Allow TCP traffic from 192.168.1.50/32192.168.1.50/32 on port 514Answer
  2. Outbound rule: Allow TCP traffic to 192.168.1.50/32192.168.1.50/32 on ports 1024-65535Answer
  3. C
    Outbound rule: Allow TCP traffic to 192.168.1.50/32192.168.1.50/32 on port 514
  4. D
    Inbound rule: Allow TCP traffic from 192.168.1.50/32192.168.1.50/32 on ports 1024-65535
  5. E
    Outbound rule: Allow TCP traffic to 192.168.1.50/32192.168.1.50/32 on ports 0-1023

Answer

To resolve the connectivity issue, the administrator must add an inbound NACL rule allowing TCP traffic from 192.168.1.50/32192.168.1.50/32 on port 514, and an outbound NACL rule allowing TCP traffic to 192.168.1.50/32192.168.1.50/32 on ephemeral ports 1024-65535.
Network ACLs are stateless. To allow the TCP connection to succeed, the inbound NACL rule must permit the initial packet on the application's service port (TCP 514). Because NACLs do not track connection state, the response packet must also be explicitly allowed outbound. The response is sent back to the client's dynamically allocated ephemeral port, which lies within the 1024-65535 range. Thus, both the inbound rule for port 514 and the outbound rule for ports 1024-65535 are required.

Step-by-Step Solution

1
Analyze the stateless nature of Network Access Control Lists (NACLs).
Realize that unlike stateful Security Groups, NACLs require explicit rules for both inbound request traffic and outbound response traffic.
Security Groups track connection state and automatically allow return traffic, but NACLs do not.
2
Determine the required inbound NACL rule configuration.
Identify that the source IP (192.168.1.50/32192.168.1.50/32) initiates a connection to the server on port 514, requiring an inbound rule for TCP port 514.
Without an inbound rule, the incoming packet to port 514 will be dropped by the default deny rule.
3
Determine the required outbound NACL rule configuration.
Identify that the return traffic from the server to the client goes to the client's ephemeral ports (1024-65535), requiring an outbound rule targeting ports 1024-65535.
Omitting outbound ephemeral ports blocks the server's TCP handshake response, resulting in a connection timeout.

Key Concept

Statelessness of Network ACLs and the requirement of ephemeral ports for return traffic.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic