Examkin

Soru

Zorluk: OrtaVPC Network Security

An organization runs a batch-processing application on Amazon EC2 instances in a private subnet (Subnet A). The application needs to write processed data to an Amazon Redshift cluster located in a separate private database subnet (Subnet B) within the same VPC. The network security team requires that all network access be restricted to the minimum necessary ports and that return traffic must be securely allowed while maintaining strict boundaries.

Which combination of configuration steps will satisfy these requirements? (Select TWO.)

  1. In the Amazon Redshift cluster's security group, add an inbound rule allowing TCP port 54395439 from the batch-processing instances' security group.Cevap
  2. B
    In the batch-processing instances' security group, add an inbound rule allowing TCP ports 1024−655351024-65535 from the Amazon Redshift cluster's security group to allow the return traffic.
  3. In the Network ACL associated with Subnet B, add an inbound rule allowing TCP port 54395439 from Subnet A's CIDR block and an outbound rule allowing TCP ports 1024−655351024-65535 to Subnet A's CIDR block.Cevap
  4. D
    In the Network ACL associated with Subnet A, add an outbound rule allowing TCP port 54395439 to Subnet B's CIDR block and remove all inbound rules since Network ACLs are stateful and track connection states.
  5. E
    Create an AWS WAF web ACL and associate it with the Amazon Redshift subnet to inspect and filter SQL connection requests on TCP port 54395439.

Cevap

In the Amazon Redshift cluster's security group, add an inbound rule allowing TCP port 54395439 from the batch-processing instances' security group; and in the Network ACL associated with Subnet B, add an inbound rule allowing TCP port 54395439 from Subnet A's CIDR block and an outbound rule allowing TCP ports 1024−655351024-65535 to Subnet A's CIDR block.
To secure the flow from Subnet A to Subnet B, Security Groups and Network ACLs must work together. The option allowing TCP port 54395439 inbound from the EC2 security group to the Redshift security group is correct because Security Groups are stateful. The option configuring both inbound traffic (port 54395439) and outbound traffic (ephemeral ports 1024−655351024-65535 for the response) in Subnet B's Network ACL is correct because Network ACLs are stateless.

Adım Adım Çözüm

1
Analyze the communication flow and port requirements.
The batch-processing instances (Subnet A) initiate TCP traffic to the Amazon Redshift cluster (Subnet B) on port 54395439.
Establishing the source, destination, protocol, and port is the first step in configuring security boundaries.
2
Configure the stateful firewall layer (Security Groups).
Create an inbound rule on the destination (Redshift) security group pointing to the source (batch EC2) security group. No outbound return rules are needed.
Security groups track connections dynamically, allowing return traffic automatically.
3
Configure the stateless firewall layer (Network ACLs).
On the destination subnet (Subnet B) Network ACL, add an inbound rule for TCP 54395439 from Subnet A CIDR, and an outbound rule for TCP 1024−655351024-65535 (ephemeral ports) to Subnet A CIDR.
Network ACLs do not track state, so return traffic must be explicitly allowed in the reverse direction.

Anahtar Kavram

Stateful vs. Stateless network filtering in AWS VPC using Security Groups and Network ACLs.
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru