Examkin

Soru

Zorluk: Çok zorVPC Network Security

A company is hosting a financial transaction processing application on Amazon EC2 instances in a private subnet (CIDR block 10.0.1.0/2410.0.1.0/24) within a VPC. The instances must meet the following network connectivity and security requirements:

1. Securely access Amazon S3 buckets to store transaction logs without traversing the public internet and without incurring data processing fees.
2. Establish outbound HTTPS connections to an external credit score API (destination IP address 203.0.113.50/32203.0.113.50/32 on TCP port 443443) while blocking all other outbound internet traffic.
3. Allow the return traffic from the external credit score API back to the EC2 instances.

A solutions architect has deployed a NAT gateway in a public subnet to handle internet egress. Which combination of network configuration steps must the solutions architect implement to satisfy these requirements? (Select TWO.)

  1. Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the private subnet.Cevap
  2. B
    Configure the private subnet's Network ACL with an outbound rule allowing TCP port 443443 to 203.0.113.50/32203.0.113.50/32. Do not configure an inbound rule for the return traffic, as Network ACLs are stateful and will automatically permit the response traffic.
  3. C
    Route all outbound traffic, including requests to Amazon S3, through the NAT gateway, and configure an Amazon S3 Interface VPC Endpoint in the public subnet to eliminate data processing fees.
  4. Configure the private subnet's Network ACL with an outbound rule allowing TCP port 443443 to 203.0.113.50/32203.0.113.50/32, and an inbound rule allowing TCP ports 1024−655351024-65535 from 203.0.113.50/32203.0.113.50/32.Cevap
  5. E
    Configure the security group attached to the EC2 instances with an inbound rule allowing TCP ports 1024−655351024-65535 from 203.0.113.50/32203.0.113.50/32 to permit return traffic from the external credit score API.

Cevap

To secure the VPC network configuration, the solutions architect must create a Gateway VPC Endpoint for Amazon S3 associated with the private subnet's route table, and configure the private subnet's Network ACL with an outbound rule allowing TCP port 443 to the target API IP and an inbound rule allowing TCP ports 1024-65535 from the target API IP.
The correct architecture combines a Gateway VPC Endpoint for Amazon S3 with a stateless Network ACL configuration. First, using a Gateway VPC Endpoint for S3 is a free service that prevents S3 traffic from routing through the NAT gateway, thereby avoiding NAT data processing fees. Second, because Network ACLs are stateless, they require both an outbound rule to permit the request to the third-party API on port 443443 and an inbound rule to permit the return traffic on the client's ephemeral port range (1024−655351024-65535) from the API's IP address.

Adım Adım Çözüm

1
Address the S3 connectivity requirement by evaluating Gateway vs Interface endpoints.
Creating a Gateway VPC Endpoint for Amazon S3 is free, does not traverse the NAT gateway, and automatically updates the private subnet's route table to direct S3-destined traffic through the endpoint.
This satisfies the requirement to access Amazon S3 securely without using the internet or incurring data transfer costs.
2
Address the stateless filtering layer (Network ACLs) for the third-party API traffic.
An outbound Network ACL rule must allow traffic to 203.0.113.50/32203.0.113.50/32 on port 443443. A corresponding inbound Network ACL rule must allow return traffic from 203.0.113.50/32203.0.113.50/32 on ephemeral ports 1024−655351024-65535.
Network ACLs are stateless; they do not track connection state, so return traffic must be explicitly permitted.
3
Address the stateful filtering layer (Security Groups) for the third-party API traffic.
The security group only needs an outbound rule allowing TCP port 443443 to 203.0.113.50/32203.0.113.50/32. No inbound rule is needed.
Security groups are stateful; once outbound traffic is allowed, return traffic is dynamically permitted.

Anahtar Kavram

Stateless Network ACLs require explicit configuration for both outbound request traffic and inbound ephemeral return traffic, whereas stateful Security Groups handle return traffic automatically.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru