Examkin

Soru

Zorluk: ZorNetwork and Infrastructure Security

A financial services firm runs compliance monitoring agents on Amazon EC2 instances within a dedicated subnet. These agents must establish outbound connections to an external regulatory API on port 443443 to upload audit logs. The security team implements a strict Network Access Control List (Network ACL) for the subnet, adding an outbound rule that permits traffic to the API's IP range on TCP port 443443. No inbound rules are added to the Network ACL. The associated Security Groups are left at their default settings (allowing all outbound traffic and no inbound traffic). During testing, the agents fail to establish a connection with the API.

Which modification is required to allow this communication while maintaining the principle of least privilege?

  1. Add an inbound rule to the Network ACL that permits traffic from the API's IP range on TCP ports 10241024-6553565535.Cevap
  2. B
    Add an inbound rule to the Security Group that permits traffic from the API's IP range on TCP port 443443.
  3. C
    Add an inbound rule to the Network ACL that permits traffic from the API's IP range on TCP port 443443.
  4. D
    Submit a request to AWS Support to open the ports at the physical virtualization layer under the Shared Responsibility Model.

Cevap

Add an inbound rule to the Network ACL that permits traffic from the API's IP range on TCP ports 10241024-6553565535.
Since Network ACLs are stateless, they require explicit rules for both outbound request traffic and inbound response traffic. When the EC2 instances initiate connections to the external API on port 443443, the return traffic is sent to ephemeral ports (10241024-6553565535) on the EC2 instances. Therefore, an inbound Network ACL rule must be added to allow traffic from the API's IP address range on ports 10241024-6553565535. Default Security Groups are stateful, meaning they track connection state and automatically allow the return traffic at the instance level without requiring any inbound Security Group rule changes.

Adım Adım Çözüm

1
Analyze the stateful behavior of the Security Group.
The default Security Group settings allow all outbound traffic. Because Security Groups are stateful, any outbound request's return traffic is automatically allowed back in. No Security Group modifications are needed.
To determine if the blockage is occurring at the instance firewall level.
2
Analyze the stateless behavior of the Network ACL.
The Network ACL is stateless, meaning outbound and inbound traffic must be explicitly permitted by separate rules. The current setup only allows outbound traffic on port 443443.
To locate the point of failure in the network path.
3
Identify the destination port of the returning traffic.
When an EC2 instance initiates a connection to port 443443 of the external API, it sends requests from a random ephemeral port (TCP range 10241024-6553565535). The API's response is sent back to this ephemeral port on the EC2 instance.
To determine the correct port range for the inbound Network ACL rule.
4
Formulate the required Network ACL rule modification.
Add an inbound rule to the Network ACL that permits traffic from the API's IP range on TCP ports 10241024-6553565535.
To allow the stateless firewall to permit the returning response traffic back to the subnet.

Anahtar Kavram

Stateful vs. Stateless Firewalls (Security Groups vs. Network ACLs) and Ephemeral Ports
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Network and Infrastructure Security

Bu konudan daha fazla soru