A solutions architect is configuring network security for a database migration. An applica… — AWS Certified Solutions Architect - Associate

A solutions architect is configuring network security for a database migration. An application running on Amazon EC2 instances in Subnet A ( $10.0.1.0/24$ ) must connect to an Amazon RDS for PostgreSQL database located in Subnet B ( $10.0.2.0/24$ ) within the same VPC. The company's security policy requires the use of Network Access Control Lists (Network ACLs) with a strict default-deny rule for both inbound and outbound traffic on all subnets. Which of the following Network ACL configurations will allow the application to connect to the database on the default PostgreSQL port while maintaining least privilege?

Configure the Network ACL for Subnet A to allow outbound traffic to Subnet B ( $10.0.2.0/24$ ) on TCP port 5432 and inbound traffic from Subnet B ( $10.0.2.0/24$ ) on TCP ports 1024–65535. Configure the Network ACL for Subnet B to allow inbound traffic from Subnet A ( $10.0.1.0/24$ ) on TCP port 5432 and outbound traffic to Subnet A ( $10.0.1.0/24$ ) on TCP ports 1024–65535.Cevap
B
Configure the Network ACL for Subnet A to allow outbound traffic to Subnet B ( $10.0.2.0/24$ ) on TCP port 5432. Configure the Network ACL for Subnet B to allow inbound traffic from Subnet A ( $10.0.1.0/24$ ) on TCP port 5432.
C
Configure the Network ACL for Subnet A to allow outbound traffic to Subnet B ( $10.0.2.0/24$ ) on TCP port 5432 and inbound traffic from Subnet B ( $10.0.2.0/24$ ) on TCP port 5432. Configure the Network ACL for Subnet B to allow inbound traffic from Subnet A ( $10.0.1.0/24$ ) on TCP port 5432 and outbound traffic to Subnet A ( $10.0.1.0/24$ ) on TCP port 5432.
D
Configure the Network ACL for Subnet A to allow outbound traffic to the security group of the database on TCP port 5432. Configure the Network ACL for Subnet B to allow inbound traffic from the security group of the EC2 instances on TCP port 5432.

Cevap

Configure the Network ACL for Subnet A to allow outbound traffic to Subnet B on TCP port 5432 and inbound traffic from Subnet B on TCP ports 1024–65535, and configure the Network ACL for Subnet B to allow inbound traffic from Subnet A on TCP port 5432 and outbound traffic to Subnet A on TCP ports 1024–65535.

The correct configuration acknowledges that Network ACLs are stateless and require rules for both inbound and outbound traffic. Because a client initiates a connection to the PostgreSQL database on TCP port 5432 using an ephemeral source port, the network path must allow outbound traffic on destination port 5432 from the client subnet and inbound traffic on the same port at the database subnet. To allow the response, the database subnet must allow outbound traffic to the ephemeral port range (

1024

–

65535

) and the client subnet must allow inbound traffic on those same ports.

Adım Adım Çözüm

Determine client-to-server traffic requirements.

Subnet A (client) must allow outbound TCP traffic to Subnet B (server) CIDR on the destination port 5432. Subnet B must allow inbound TCP traffic from Subnet A CIDR on destination port 5432.

This establishes the forward connection path from the application to the database.

Determine server-to-client return traffic requirements considering statelessness.

Subnet B must allow outbound TCP traffic to Subnet A CIDR on destination ephemeral ports (1024–65535). Subnet A must allow inbound TCP traffic from Subnet B CIDR on destination ephemeral ports (1024–65535).

Since Network ACLs are stateless, return traffic is not tracked automatically and must be explicitly allowed on the ephemeral ports allocated by the client OS.

Anahtar Kavram

Statelessness of Network Access Control Lists (NACLs) and the requirement of ephemeral port ranges for return traffic.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru