Examkin

Soru

Zorluk: OrtaVPC Network Security

A solutions architect is designing the network security for a two-tier application in a VPC. The database tier runs on Amazon EC2 instances in a private subnet, and the web tier runs in a public subnet. The database instances must accept incoming database connections on TCP port 3306 from the web tier. Additionally, the database instances must be able to download software updates from the internet over HTTPS (TCP port 443) via a NAT Gateway. No other outbound connections from the database instances should be allowed. The architect wants to implement these controls using both Security Groups and Network Access Control Lists (Network ACLs) under the principle of least privilege. Which combination of configurations will satisfy these requirements? (Select TWO.)

  1. Configure the database security group with an inbound rule that allows TCP port 3306 from the web security group, and an outbound rule that allows TCP port 443 to 0.0.0.0/0.Cevap
  2. Configure the database subnet Network ACL with inbound rules allowing TCP port 3306 from the web subnet CIDR and TCP ports 1024-65535 from 0.0.0.0/0, and outbound rules allowing TCP ports 1024-65535 to the web subnet CIDR and TCP port 443 to 0.0.0.0/0.Cevap
  3. C
    Configure the database security group with inbound rules allowing TCP port 3306 from the web security group and TCP ports 1024-65535 from 0.0.0.0/0, and outbound rules allowing TCP ports 1024-65535 to the web security group and TCP port 443 to 0.0.0.0/0.
  4. D
    Configure the database subnet Network ACL with an inbound rule allowing TCP port 3306 from the web subnet CIDR, and an outbound rule allowing TCP port 443 to 0.0.0.0/0, with no rules for ephemeral ports.
  5. E
    Associate an AWS WAF web ACL directly with the database subnet to inspect incoming traffic on port 3306 and block unauthorized requests.

Cevap

To secure the database tier, configure the database security group to statefully allow inbound TCP port 3306 from the web security group and outbound TCP port 443 to the internet. Additionally, configure the stateless Network ACL on the database subnet to allow inbound TCP port 3306 and ephemeral ports (1024-65535) for return traffic, and outbound TCP port 443 and ephemeral ports for return traffic.
The correct configurations properly apply stateful rules to the security group and stateless rules (including ephemeral ports) to the subnet Network ACL. The security group needs inbound port 3306 and outbound port 443, as it automatically tracks connections. The Network ACL requires inbound port 3306 and outbound port 443, along with outbound ephemeral ports (for database query responses) and inbound ephemeral ports (for software patch download responses).

Adım Adım Çözüm

1
Determine the stateful security requirements at the instance level.
The database instances require a security group that allows inbound traffic on port 3306 from the web tier security group and outbound traffic on port 443 to the internet. Because security groups are stateful, return traffic is tracked and allowed automatically without requiring ephemeral port rules.
This satisfies the requirement to filter traffic at the instance level statefully.
2
Determine the stateless security requirements at the subnet level.
The database subnet Network ACL (NACL) must be configured to allow inbound queries (port 3306) and outbound patches (port 443). Because NACLs are stateless, we must also add rules to allow return traffic on ephemeral ports (1024-65535) for both directions.
This satisfies the requirement to filter traffic at the subnet level statelessly.

Anahtar Kavram

Stateful Security Groups vs Stateless Network ACLs
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru