Examkin

Soru

Zorluk: ZorNetwork and Infrastructure Security

A financial services company is hosting a payment processing application on Amazon EC2 instances inside a private subnet. The instances must initiate outbound HTTPS connections (port 443) to an external payment gateway API and receive the responses. The security team requires that network access controls be configured at both the subnet boundary and the instance level. Which two configuration steps must the cloud practitioner take to allow this traffic while maintaining a secure architecture? (Select TWO.)

  1. Add an outbound rule to the Security Group allowing TCP port 443 traffic to the destination IP range.Cevap
  2. Add an outbound rule to the Network ACL allowing TCP port 443 traffic, and an inbound rule allowing TCP traffic on ephemeral ports 1024-65535 from the destination IP range.Cevap
  3. C
    Add an inbound rule to the Security Group on TCP port 443 to allow return traffic, because Security Groups are stateless.
  4. D
    Add only an outbound rule to the Network ACL allowing TCP port 443 traffic, since Network ACLs are stateful and automatically permit return traffic.
  5. E
    Enable Amazon Inspector on the private subnet to dynamically adjust Network ACL rules to permit return traffic from the external API.

Cevap

Configure the Security Group with an outbound rule allowing TCP port 443 to the destination IP range, and configure the Network ACL with both an outbound rule for TCP port 443 and an inbound rule allowing response traffic on ephemeral ports (1024-65535).
Security Groups operate at the instance level and are stateful. This means that if an outbound rule is created to allow traffic to a destination (such as TCP port 443 to the payment gateway), the return traffic is automatically allowed back in without requiring a corresponding inbound rule. Network Access Control Lists (Network ACLs) operate at the subnet boundary and are stateless. This means that rules must be explicitly created for both outbound and inbound traffic. For outbound connections initiated by the EC2 instances, the outbound rule must allow TCP port 443 to the destination, and the inbound rule must allow the response traffic coming back on ephemeral ports (typically 1024-65535) from the destination.

Adım Adım Çözüm

1
Analyze the security controls at the instance level (Security Group).
Since Security Groups are stateful, allowing outbound TCP port 443 traffic to the API gateway is sufficient to also allow the return traffic. No inbound rule is required.
To grant outbound-initiated communication at the instance level while leveraging Security Group's stateful tracking.
2
Analyze the security controls at the subnet boundary (Network ACL).
Since Network ACLs are stateless, traffic must be allowed explicitly in both directions. Outbound traffic needs a rule for TCP port 443, and inbound return traffic needs a rule for ephemeral ports (1024-65535) because client connections use a random source port in that range.
To ensure both request and response packets can cross the subnet boundary.

Anahtar Kavram

The difference between stateful Security Groups (instance-level) and stateless Network ACLs (subnet-level) in managing outbound traffic and its inbound responses.
Bu soruyu puanla

Konular

Network and Infrastructure Security

Bu konudan daha fazla soru