Examkin

Question

Difficulty: MediumNetwork Security Controls (Security Groups and NACLs)

An application running on Amazon EC2 instances in a private subnet (10.0.1.0/2410.0.1.0/24) must consume an internal web service hosted on EC2 instances in a database/services subnet (10.0.2.0/2410.0.2.0/24) on TCP port 8080. The security groups for both tiers are correctly configured. A custom Network Access Control List (NACL) associated with the private subnet (10.0.1.0/2410.0.1.0/24) has an outbound rule allowing TCP port 8080 to 10.0.2.0/2410.0.2.0/24, and an inbound rule allowing TCP port 8080 from 10.0.2.0/2410.0.2.0/24. The default deny rule is active. The instances cannot establish a connection. Which configuration change must be made to the private subnet's NACL to resolve this connectivity issue?

  1. Modify the inbound rule of the private subnet's NACL to allow TCP traffic from 10.0.2.0/2410.0.2.0/24 on destination ports 1024−655351024-65535.Answer
  2. B
    No NACL changes are required because Security Groups are stateful and will automatically permit the inbound response traffic.
  3. C
    Modify the outbound rule of the private subnet's NACL to allow TCP traffic to 10.0.2.0/2410.0.2.0/24 on destination ports 1024−655351024-65535.
  4. D
    Modify the inbound rule of the private subnet's NACL to allow TCP traffic from 10.0.2.0/2410.0.2.0/24 on source ports 1024−655351024-65535.

Answer

Modify the inbound rule of the private subnet's NACL to allow TCP traffic from 10.0.2.0/2410.0.2.0/24 on destination ports 1024−655351024-65535.
The correct option is to modify the inbound rule of the private subnet's NACL to allow TCP traffic from the destination subnet on destination ports in the ephemeral range (1024−655351024-65535). Because NACLs are stateless, they require explicit inbound rules to allow the return traffic of an outbound connection. When a client initiates a connection to a server on port 8080, the return traffic sent by the server will have a source port of 8080 and a destination port within the ephemeral port range (1024−655351024-65535) allocated by the client's operating system.

Step-by-Step Solution

1
Analyze the connection flow and source/destination ports.
The application client in the private subnet initiates a connection to the server in the database subnet. Outbound packet: Source IP 10.0.1.X10.0.1.X, Source Port: Ephemeral (1024−655351024-65535), Destination IP 10.0.2.Y10.0.2.Y, Destination Port: 80808080. Inbound response packet: Source IP 10.0.2.Y10.0.2.Y, Source Port: 80808080, Destination IP 10.0.1.X10.0.1.X, Destination Port: Ephemeral (1024−655351024-65535).
Understanding the stateless nature of NACLs requires verifying the ports for both request and response packets.
2
Evaluate the current NACL rules against the traffic flow.
The current outbound rule allows destination port 8080, which permits the request to exit the private subnet. The current inbound rule only allows destination port 8080. However, the incoming response packet has a destination port in the ephemeral range (1024−655351024-65535), so it is blocked by the default deny rule.
Identifying where the traffic is blocked allows targeted correction of the rules.
3
Determine the necessary change to allow the return path.
Add or modify the inbound NACL rule for the private subnet to allow inbound TCP traffic from the subnet 10.0.2.0/2410.0.2.0/24 on destination ports 1024−655351024-65535.
Since NACLs are stateless, they must explicitly allow the return traffic on the ephemeral port range.

Key Concept

Stateless Network Access Control Lists (NACLs) require explicit rules for both inbound and outbound traffic, including allowing return traffic on ephemeral port ranges.
Rate this question

Topics

Network Security Controls (Security Groups and NACLs)

More questions from this topic