A company has an application running on Amazon EC2 instances in a private subnet. The appl… — AWS Certified Solutions Architect - Associate

A company has an application running on Amazon EC2 instances in a private subnet. The application must communicate with an external third-party service over HTTPS (port 443). The network security team requires that no traffic is allowed to exit or enter the VPC except what is strictly required for this application to communicate with the external service's public IP range ( $203.0.113.0/24$ ). The subnets use a custom Network ACL (NACL) and the EC2 instances use a custom Security Group.

Which configuration of Security Groups and Network ACLs will securely allow this communication while maintaining the principle of least privilege?

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to $203.0.113.0/24$ , and no inbound rules. Configure the Network ACL with an outbound rule allowing HTTPS (port 443) to $203.0.113.0/24$ , and an inbound rule allowing TCP traffic on ephemeral ports ( $1024-65535$ ) from $203.0.113.0/24$ .Cevap
B
Configure the Security Group with an outbound rule allowing HTTPS (port 443) to $203.0.113.0/24$ , and an inbound rule allowing TCP traffic on ephemeral ports ( $1024-65535$ ) from $203.0.113.0/24$ . Configure the Network ACL with an outbound rule allowing HTTPS (port 443) to $203.0.113.0/24$ , and no inbound rules.
C
Configure the Security Group with an outbound rule allowing HTTPS (port 443) to $203.0.113.0/24$ , and no inbound rules. Configure the Network ACL with an outbound rule allowing HTTPS (port 443) to $203.0.113.0/24$ , and an inbound rule allowing HTTPS (port 443) from $203.0.113.0/24$ .
D
Configure the Security Group with an outbound rule allowing HTTPS (port 443) to $203.0.113.0/24$ , and no inbound rules. Configure the Network ACL with an outbound rule allowing all traffic ( $0.0.0.0/0$ ) and configure AWS WAF on the subnet to restrict outbound traffic destinations to $203.0.113.0/24$ .

Cevap

Configure the Security Group with an outbound rule allowing HTTPS (port 443) to the destination IP range, and configure the Network ACL with an outbound rule allowing HTTPS (port 443) to the destination IP range and an inbound rule allowing TCP traffic on ephemeral ports from the destination IP range.

The correct option correctly applies the stateful nature of Security Groups and the stateless nature of Network ACLs. Security Groups only require an outbound rule for port 443 because they are stateful and automatically track and allow the return traffic. Network ACLs, being stateless, require rules in both directions: an outbound rule to allow traffic to the service on port 443, and an inbound rule to allow the return traffic from the service back to the client's ephemeral ports (

1024-65535

Adım Adım Çözüm

Determine the required Security Group configuration for the EC2 instances.

Since Security Groups are stateful, configuring an outbound rule to allow HTTPS (port 443) to

203.0.113.0/24

is sufficient. Return traffic is tracked and permitted automatically, so no inbound rules are required.

To grant outbound-only access while minimizing the attack surface by leaving inbound rules empty.

Determine the required Network ACL outbound configuration for the subnet.

Since Network ACLs are stateless, configure an outbound rule allowing TCP port 443 traffic to

203.0.113.0/24

To allow the outbound connection request to reach the external service.

Determine the required Network ACL inbound configuration for the subnet.

Configure an inbound rule allowing TCP traffic from

203.0.113.0/24

on ephemeral ports (

1024-65535

Since Network ACLs are stateless, the return traffic sent by the external service to the client's ephemeral ports must be explicitly allowed.

Anahtar Kavram

Stateful vs. Stateless Filtering in VPC Network Security

Tahmini Süre:1m 30s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru