An architectural design for a secure application separates the processing service (deploye… — AWS Certified Solutions Architect - Associate

An architectural design for a secure application separates the processing service (deployed in subnet $172.16.1.0/24$ ) and the database cluster (deployed in subnet $172.16.2.0/24$ ). The database listens on custom TCP port $8000$ . A solutions architect is configuring a Network Access Control List (Network ACL) for the database subnet to restrict traffic. The database instances are already associated with a security group that allows inbound traffic on port $8000$ from the processing service's security group. Which configuration must be applied to the database subnet's Network ACL to allow successful communication between the services?

A
An inbound rule allowing TCP port $8000$ from the processing service's security group ID and an outbound rule allowing TCP ports $1024 - 65535$ to the processing service's security group ID.
An inbound rule allowing TCP port $8000$ from $172.16.1.0/24$ and an outbound rule allowing TCP ports $1024 - 65535$ to $172.16.1.0/24$ .Cevap
C
An inbound rule allowing TCP port $8000$ from $172.16.1.0/24$ , with no outbound rule required because Network ACLs automatically track connection states.
D
An inbound rule allowing TCP ports $1024 - 65535$ from $172.16.1.0/24$ and an outbound rule allowing TCP port $8000$ to $172.16.1.0/24$ .

Cevap

An inbound rule allowing TCP port

8000

from

172.16.1.0/24

and an outbound rule allowing TCP ports

1024 - 65535

172.16.1.0/24

The correct option correctly configures the stateless Network ACL. The inbound rule allows the processing service's subnet (

172.16.1.0/24

) to connect to the database subnet on port

8000

. Since Network ACLs do not track connection states, a corresponding outbound rule is required to allow return traffic from the database back to the processing service's client instances. Because client instances initiate connections from random ports within the ephemeral port range (

1024 - 65535

), the outbound rule must allow traffic to those ports.

Adım Adım Çözüm

Analyze the state tracking characteristics of Network ACLs vs Security Groups.

Security groups are stateful, but Network ACLs are stateless. Therefore, the database subnet Network ACL must contain explicit rules for both inbound request traffic and outbound return traffic.

This establishes that both an inbound rule and an outbound rule are required for successful network communication.

Determine the correct source and destination targets for Network ACLs.

Identify that Network ACL rules must use CIDR blocks (such as

172.16.1.0/24

), because Network ACLs do not support security group references.

This rules out options that attempt to reference security group IDs inside Network ACL rules.

Map the ports for the inbound and outbound traffic directions.

The inbound rule must allow target port

8000

from the client's subnet CIDR. The outbound rule must allow return traffic to the client's ephemeral ports (

1024 - 65535

) on the client's subnet CIDR.

When a client connects to a server, it uses a random ephemeral port as its source port. Return traffic must be allowed back to this ephemeral port range.

Anahtar Kavram

Stateless nature of Network ACLs and the requirement for ephemeral port rules.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru