Examkin

Soru

Zorluk: OrtaVPC Network Security

A company is hosting a reporting application on Amazon EC2 instances in a private subnet with CIDR block 10.0.4.0/2410.0.4.0/24. The database tier runs on EC2 instances in a separate private subnet with CIDR block 10.0.5.0/2410.0.5.0/24. The reporting application must initiate queries to the database on TCP port 54325432. The company's security policy requires using both security groups and network ACLs to enforce strict isolation. The database must not be allowed to initiate any connections back to the reporting application. Which combination of actions will allow this traffic while maintaining the required security boundaries? (Select TWO.)

  1. Configure the database security group to allow inbound traffic on TCP port 54325432 from the reporting application's security group.Cevap
  2. Configure the network ACL associated with the database subnet to allow inbound traffic on TCP port 54325432 from 10.0.4.0/2410.0.4.0/24 and outbound traffic on TCP ports 1024−655351024-65535 to 10.0.4.0/2410.0.4.0/24.Cevap
  3. C
    Configure the database security group to allow inbound traffic on TCP port 54325432 from the reporting application's security group, and add an outbound rule to allow return traffic on ephemeral ports.
  4. D
    Configure the network ACL associated with the database subnet to allow inbound traffic on TCP port 54325432 from 10.0.4.0/2410.0.4.0/24, and rely on the stateful nature of network ACLs to permit the return database response.
  5. E
    Associate an AWS WAF Web ACL with the database subnet to inspect incoming database traffic and block unauthorized queries from the reporting subnet.

Cevap

Configure the database security group to allow inbound traffic on TCP port 54325432 from the reporting application's security group, and configure the network ACL associated with the database subnet to allow inbound traffic on TCP port 54325432 from 10.0.4.0/2410.0.4.0/24 and outbound traffic on TCP ports 1024−655351024-65535 to 10.0.4.0/2410.0.4.0/24.
The correct architecture requires a combination of stateful security group rules and stateless network ACL rules. The database security group must allow inbound traffic on TCP port 54325432 from the source security group; because security groups are stateful, return traffic is automatically allowed. The database subnet's network ACL must allow inbound traffic on port 54325432 from the reporting subnet CIDR block, and since network ACLs are stateless, an outbound rule must also be configured to allow return traffic on the ephemeral port range (1024−655351024-65535) back to the reporting subnet.

Adım Adım Çözüm

1
Configure the stateful firewall (Security Group) for the database.
Create an inbound rule allowing TCP port 54325432 from the reporting security group. No outbound rule is needed since security groups are stateful and track connection state.
Security groups evaluate traffic at the instance level and automatically allow return traffic for established sessions.
2
Configure the stateless firewall (Network ACL) rules for the database subnet.
Add an inbound rule allowing TCP port 54325432 from the reporting subnet (10.0.4.0/2410.0.4.0/24) and an outbound rule allowing TCP ports 1024−655351024-65535 to the reporting subnet (10.0.4.0/2410.0.4.0/24).
Network ACLs operate at the subnet boundary and are stateless. Return traffic must be explicitly allowed using the ephemeral port range of the initiator.

Anahtar Kavram

Stateful vs. Stateless VPC Filtering
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru