Examkin

Soru

Zorluk: OrtaVPC Network Security

A company is deploying a two-tier application in a VPC. The application tier runs on Amazon EC2 instances in a private subnet with CIDR block 10.0.1.0/2410.0.1.0/24. The database tier runs on an Amazon RDS for SQL Server DB instance in a separate database subnet with CIDR block 10.0.2.0/2410.0.2.0/24. The database instance listens on TCP port 14331433. The network architecture requires using a custom Network Access Control List (Network ACL) for the database subnet to restrict traffic. Which combination of Network ACL rules must be applied to the database subnet to allow the application tier to connect to the database?

  1. An inbound rule that allows TCP traffic on port 14331433 from 10.0.1.0/2410.0.1.0/24, and an outbound rule that allows TCP traffic on ports 1024−655351024-65535 to 10.0.1.0/2410.0.1.0/24.Cevap
  2. B
    An inbound rule that allows TCP traffic on port 14331433 from 10.0.1.0/2410.0.1.0/24, and an outbound rule that allows TCP traffic on port 14331433 to 10.0.1.0/2410.0.1.0/24.
  3. C
    An inbound rule that allows TCP traffic on port 14331433 from 10.0.1.0/2410.0.1.0/24, with no outbound rules required because Network ACLs automatically track connection state.
  4. D
    An inbound rule that allows TCP traffic on port 14331433 from the Security Group ID of the application tier EC2 instances, and an outbound rule that allows all traffic to 0.0.0.0/00.0.0.0/0.

Cevap

An inbound rule that allows TCP traffic on port 14331433 from 10.0.1.0/2410.0.1.0/24, and an outbound rule that allows TCP traffic on ports 1024−655351024-65535 to 10.0.1.0/2410.0.1.0/24.
Network ACLs are stateless filters that apply to subnets. A database connection requires an inbound rule to allow traffic from the application subnet to the database port (14331433). Because Network ACLs do not track connection states, a corresponding outbound rule must be created to allow the database's responses back to the application subnet. Since clients initiate connections from a random port within their ephemeral port range (1024−655351024-65535), the outbound rule must allow traffic to this destination port range.

Adım Adım Çözüm

1
Determine the stateless nature of Network ACLs
Identify that both inbound traffic (requests) and outbound traffic (responses) must be explicitly allowed by the Network ACL.
Unlike security groups, Network ACLs do not automatically permit return traffic.
2
Determine the traffic ports for the inbound request
Allow inbound TCP traffic on port 14331433 (SQL Server) originating from the application subnet CIDR 10.0.1.0/2410.0.1.0/24.
This allows the application instances to initiate a connection to the SQL Server database.
3
Identify the return port range for outbound responses
Allow outbound TCP traffic to the client's ephemeral port range 1024−655351024-65535 destined for the application subnet 10.0.1.0/2410.0.1.0/24.
When a client establishes a connection, it uses an ephemeral port as the source port. The database responds back to this port range, which must be allowed through the stateless Network ACL.

Anahtar Kavram

VPC Network ACL Statelessness and Ephemeral Ports
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru