Examkin

Soru

Zorluk: Çok zorNetwork and Infrastructure Security

An organization hosts a multi-tier web application where Amazon EC2 instances in a private subnet receive traffic from a public-facing Application Load Balancer (ALB). The security team configures the EC2 instances' Security Group to allow inbound HTTP traffic on port 80 only from the ALB's Security Group, and allowed all outbound traffic. At the subnet level, the Network ACL (NACL) is modified to allow inbound HTTP traffic on port 80 from the ALB's private IP range, and allow outbound HTTP traffic on port 80 to the ALB's private IP range, with all other traffic blocked by default rules. Users report receiving 502 Bad Gateway errors from the ALB. Which configuration change is required to resolve this issue and allow successful traffic flow?

  1. Modify the subnet's outbound Network ACL rules to allow traffic to the ALB's private IP range on ephemeral ports (1024-65535).Cevap
  2. B
    Add an outbound rule to the EC2 instances' Security Group to explicitly allow return traffic to the ALB's IP range on ephemeral ports.
  3. C
    Submit a request to AWS Support to configure the Network ACL to operate statefully, as subnet-level configurations are managed by AWS.
  4. D
    Use Amazon Inspector to analyze the EC2 network interfaces and automatically resolve the routing failure.

Cevap

Modify the subnet's outbound Network ACL rules to allow traffic to the ALB's private IP range on ephemeral ports (1024-65535).
The correct option is to modify the subnet's outbound Network ACL to allow traffic to the ALB's private IP range on ephemeral ports (1024-65535). Because Network ACLs are stateless, return traffic from the EC2 instances back to the ALB must be explicitly allowed. A client connection (from the ALB) uses a random ephemeral port to initiate the request, meaning the EC2 instance must reply to a destination port in the 1024-65535 range rather than port 80.

Adım Adım Çözüm

1
Analyze the stateful nature of Security Groups.
Since the security group allows inbound traffic on port 80, return traffic is automatically tracked and allowed outbound at the instance layer without additional outbound rules.
Security Groups operate at the instance level and are stateful.
2
Analyze the stateless nature of Network ACLs.
Subnet-level Network ACLs do not track connection states. For any allowed inbound request, the corresponding return traffic must be explicitly permitted in the outbound rules.
Network ACLs operate at the subnet level and are stateless.
3
Determine the destination port of the return traffic.
When a client (the ALB) establishes a TCP connection to a server (the EC2 instance on port 80), the client uses a temporary, high-numbered port known as an ephemeral port (typically 1024-65535) to receive the response.
TCP return connections are directed to the client's ephemeral port, not the service port.
4
Identify the misconfiguration and correct it.
The current outbound Network ACL only allows outbound traffic on port 80, causing the return packets destined for the ALB's ephemeral ports to be blocked by the default deny rule. Allowing outbound traffic to the ALB's IP range on ports 1024-65535 resolves the issue.
Explicitly permitting ephemeral port traffic in the outbound Network ACL is mandatory for stateless return path communications.

Anahtar Kavram

The stateful behavior of Security Groups versus the stateless behavior of Network ACLs, and the requirement of ephemeral ports for return traffic in stateless configurations.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Network and Infrastructure Security

Bu konudan daha fazla soru