Examkin

Question

Difficulty: MediumVPC Security Controls and Traffic Analysis

A SysOps Administrator is configuring IPv6 connectivity for a web application tier located in a private subnet. The instances must be able to initiate outbound connections to external IPv6 services for software updates, but external hosts must not be allowed to initiate connections to the instances. The administrator has created and attached an egress-only internet gateway to the VPC. Which of the following actions must the administrator perform to allow the instances to successfully establish these connections? (Select TWO.)

  1. Add a route to the private subnet's route table with a destination of `::/0` pointing to the egress-only internet gateway.Answer
  2. Configure the private subnet's Network ACL to allow outbound IPv6 traffic to `::/0` and allow inbound IPv6 traffic from `::/0` on TCP ports 10241024-6553565535.Answer
  3. C
    Configure the instance security group's inbound rules to allow traffic from `::/0` on TCP ports 10241024-6553565535.
  4. D
    Add a route to the private subnet's route table with a destination of `::/0` pointing to a NAT gateway located in a public subnet.
  5. E
    Enable the 'Assign IPv6 Address' attribute on the NAT gateway and configure it as the target for `::/0` in the private subnet's route table.

Answer

To allow private subnet instances to make outbound IPv6 connections, you must add a route in the subnet's route table for `::/0` targeting the egress-only internet gateway, and configure the stateless Network ACL to allow outbound IPv6 traffic and inbound response traffic on ephemeral ports (10241024-6553565535).
The correct solution involves configuring routing and network ACLs. First, adding a route for `::/0` targeting the egress-only internet gateway in the subnet's route table ensures that outbound IPv6 traffic is correctly forwarded. Second, because Network ACLs are stateless, they do not track connection states. Therefore, an inbound rule must be configured to allow the return traffic from the external servers on ephemeral ports (TCP 10241024-6553565535).

Step-by-Step Solution

1
Configure the routing path for IPv6 traffic.
Add a route for `::/0` targeting the egress-only internet gateway in the route table of the private subnet.
This tells the VPC router where to direct outbound IPv6 traffic originating from the subnet.
2
Ensure stateless network firewalls permit the bi-directional traffic flow.
Update the subnet's Network ACL (NACL) to allow outbound IPv6 traffic to `::/0` and allow inbound response traffic from `::/0` on ephemeral ports (10241024-6553565535).
Because NACLs are stateless, they evaluate ingress and egress traffic independently. The return packets of outbound connections will be dropped unless ephemeral ports are allowed inbound.
3
Verify stateful security group rules.
The instance security group must allow outbound traffic, but no inbound rules for ephemeral ports are needed.
Security groups are stateful and automatically permit return traffic for established outbound connections.

Key Concept

Egress-Only Internet Gateway routing and stateless Network ACL rules for IPv6 traffic
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic