Examkin

Question

Difficulty: MediumVPC Security Controls and Traffic Analysis

A SysOps Administrator is troubleshooting a connectivity issue for a web server hosted on an Amazon EC2 instance with private IP address 10.0.1.100. Clients are unable to load pages from the web server. The administrator enables VPC Flow Logs on the instance's elastic network interface (ENI) and observes the following log records:

2 123456789012 eni-1234567890abcdef 203.0.113.10 10.0.1.100 50001 80 6 10 520 1620000000 1620000060 ACCEPT OK
2 123456789012 eni-1234567890abcdef 10.0.1.100 203.0.113.10 80 50001 6 5 260 1620000000 1620000060 REJECT OK

Which action should the administrator take to resolve this issue?

  1. Add an outbound rule to the Network ACL associated with the subnet to allow TCP traffic to destination ports 1024-65535.Answer
  2. B
    Add an outbound rule to the Security Group associated with the EC2 instance to allow TCP traffic to destination port 50001.
  3. C
    Add a route targeting the Internet Gateway (IGW) in the subnet's route table for the destination 203.0.113.10/32.
  4. D
    Recreate the VPC Flow Log using an IAM role that has the iam:PassRole permission.

Answer

Add an outbound rule to the Network ACL associated with the subnet to allow TCP traffic to destination ports 1024-65535.
The correct answer is to add an outbound rule to the Network ACL associated with the subnet to allow TCP traffic to destination ports 1024-65535. Network ACLs are stateless, meaning return traffic must be explicitly allowed. Since the client's request on port 80 uses an ephemeral source port (50001), the outbound response from the web server is destined for port 50001. Outbound rules in the Network ACL must permit this ephemeral range.

Step-by-Step Solution

1
Analyze the VPC Flow Log records to identify the traffic flow.
The first log record shows inbound traffic from client IP 203.0.113.10 (port 50001) to the web server 10.0.1.100 (port 80) was ACCEPTed. The second log record shows outbound return traffic from the web server 10.0.1.100 (port 80) to the client 203.0.113.10 (port 50001) was REJECTed.
Understanding the source, destination, ports, and action of both requests helps pinpoint where the packet drop occurs.
2
Evaluate the stateful/stateless nature of the security controls.
Since Security Groups are stateful, any inbound traffic that is allowed automatically permits the return outbound traffic. Because the inbound request was accepted but the outbound response was rejected, the block must be due to a stateless control (a Network ACL).
Distinguishing between stateful Security Groups and stateless Network ACLs is critical for identifying the cause of outbound traffic rejection.
3
Determine the necessary rule modification for the stateless control.
The outbound return traffic is destined for port 50001, which is in the ephemeral port range (1024-65535). An outbound rule must be added to the Network ACL to allow traffic to these ports.
Stateless Network ACLs require explicit rules for both inbound and outbound traffic, including client ephemeral ports.

Key Concept

Stateless nature of Network ACLs requiring explicit outbound rules for ephemeral ports
Estimated Time:1m 30s
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic