An application tier deployed on Amazon EC2 instances in Subnet App (10.120.10.0/24) must c… — AWS Certified SysOps Administrator - Associate

An application tier deployed on Amazon EC2 instances in Subnet App ( $10.120.10.0/24$ ) must connect to a MongoDB database cluster running on EC2 instances in Subnet DB ( $10.120.20.0/24$ ) on TCP port $27017$ . Both subnets are associated with custom Network Access Control Lists (NACLs) that currently deny all traffic by default. The associated Security Groups are already configured to allow all required database traffic.

Which two NACL rules must be added to the Subnet DB NACL to successfully allow this database communication? (Select two.)

An inbound rule that allows TCP traffic on port $27017$ from source CIDR $10.120.10.0/24$ .Answer
An outbound rule that allows TCP traffic on ports $1024$ - $65535$ to destination CIDR $10.120.10.0/24$ .Answer
C
An outbound rule that allows TCP traffic on port $27017$ to destination CIDR $10.120.10.0/24$ .
D
An inbound rule that allows TCP traffic on ports $1024$ - $65535$ from source CIDR $10.120.10.0/24$ .
E
An inbound rule that allows TCP traffic on port $27017$ from source CIDR $10.120.10.0/24$ , relying on the security group's stateful tracking to permit the outbound database response.

Answer

To allow the connection, the database subnet's NACL needs an inbound rule allowing TCP traffic on port 27017 from the application subnet, and an outbound rule allowing response traffic on ephemeral ports 1024-65535 back to the application subnet.

The correct configurations are the inbound rule to allow traffic on the database listening port and the outbound rule to allow return traffic on ephemeral ports. Since NACLs are stateless, they require separate rules for both directions. The inbound rule allows the connection request to reach the database, and the outbound rule allows the response to return to the client's ephemeral port range.

Step-by-Step Solution

Identify the stateless behavior of NACLs.

Recognize that rules must be configured for both request (inbound) and response (outbound) paths on the Subnet DB NACL, regardless of the Security Group configuration.

Unlike stateful security groups, NACLs do not track connection state and require explicit rules for return traffic.

Configure the inbound rule to allow the database request.

Allow TCP port 27017 from the source application subnet CIDR of

10.120.10.0/24

This allows the application instances to initiate connection handshakes to the MongoDB service running in the database subnet.

Configure the outbound rule to allow the response path.

Allow TCP ports 1024-65535 to the destination application subnet CIDR of

10.120.10.0/24

Connection responses from the database server must reach the application instances on the client's ephemeral port range (1024-65535).

Key Concept

Stateless nature of Network Access Control Lists (NACLs) and ephemeral port requirements.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic