A solutions architect is configuring network security for a new cache tier in a VPC. A clu… — AWS Certified Solutions Architect - Associate

A solutions architect is configuring network security for a new cache tier in a VPC. A cluster of Redis instances is deployed in a private subnet ( $10.0.2.0/24$ ) and must accept inbound cache requests on TCP port $6379$ from web application servers located in a public subnet ( $10.0.1.0/24$ ). The solutions architect configures a custom Network Access Control List (Network ACL) for the private subnet with the following rules:

* Inbound: Rule $100$ – Allow TCP port $6379$ from $10.0.1.0/24$
* Outbound: Rule $100$ – Allow TCP port $6379$ to $10.0.1.0/24$
* Both inbound and outbound default rules (Rule $*$ ) are set to deny all other traffic.

The web application servers are unable to establish a connection to the Redis instances. Which configuration change to the private subnet's Network ACL will resolve this issue?

Change the outbound rule to allow TCP traffic to $10.0.1.0/24$ on ports $1024-65535$ .Cevap
B
Change the inbound rule to allow TCP traffic from $10.0.1.0/24$ on ports $1024-65535$ .
C
Configure the security group of the Redis instances to allow outbound TCP traffic to $10.0.1.0/24$ on ports $1024-65535$ .
D
Remove the outbound Network ACL rule entirely, as Network ACLs are stateful and automatically permit return traffic.

Cevap

Change the outbound rule to allow TCP traffic to the public subnet on the ephemeral port range (

1024-65535

The correct option is the one recommending changing the outbound Network ACL rule to allow TCP traffic to the public subnet on the ephemeral port range. Because Network ACLs are stateless, they do not automatically allow return traffic. When the web application servers connect to Redis on port

6379

, they use a client-side ephemeral port (in the range

1024-65535

) for the source. The response from Redis is sent from source port

6379

to the destination ephemeral port on the web server. Therefore, the private subnet's outbound Network ACL must permit TCP traffic to the public subnet's CIDR block on ports

1024-65535

Adım Adım Çözüm

Analyze the statefulness of the network security components in the VPC.

Security groups are stateful, but Network ACLs are stateless and evaluate traffic in both directions independently.

Understanding statelessness is critical because return traffic must be explicitly allowed by the Network ACL.

Identify the port mapping for the client-server communication.

The client (web application server) initiates a connection to the server (Redis) on port

6379

. The return traffic from Redis is sent from port

6379

to the client's ephemeral port range (

1024-65535

This determines which ports must be opened in each direction of the Network ACL.

Verify the private subnet's Network ACL rules against this port mapping.

The inbound rule correctly allows traffic to destination port

6379

. However, the outbound rule only allows destination port

6379

, which blocks the return traffic destined for the client's ephemeral ports (

1024-65535

Identifying this mismatch pinpoints the root cause of the connection failure.

Determine the required modification to resolve the block.

Update the outbound rule of the private subnet's Network ACL to allow TCP traffic to

10.0.1.0/24

on ports

1024-65535

This permits the stateless Network ACL to pass the response traffic back to the web servers.

Anahtar Kavram

Stateless nature of Network ACLs requiring return traffic on ephemeral ports

Tahmini Süre:1m 30s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru