Examkin

Soru

Zorluk: ZorVPC Security Controls and Traffic Analysis

A SysOps administrator is troubleshooting connectivity between an application tier in private subnet 10.0.2.0/2410.0.2.0/24 and a PostgreSQL database instance (10.0.3.8910.0.3.89) in private subnet 10.0.3.0/2410.0.3.0/24. The database instance's security group is already configured to allow inbound TCP traffic on port 54325432 from the application tier's security group.

VPC Flow Logs are enabled on the network interface of the database instance and record the following entry:
`2 123456789012 eni-0123456789abcdef0 10.0.2.45 10.0.3.89 49152 5432 6 1 40 1620000000 1620000010 REJECT OK`

Which TWO configuration changes are required to resolve this issue and allow successful database connections? (Select TWO.)

  1. Add an inbound rule to the database subnet's Network ACL that allows TCP traffic on port 54325432 from source CIDR 10.0.2.0/2410.0.2.0/24.Cevap
  2. Add an outbound rule to the database subnet's Network ACL that allows TCP traffic on ephemeral ports (1024−655351024-65535) to destination CIDR 10.0.2.0/2410.0.2.0/24.Cevap
  3. C
    Add an outbound rule to the database instance's security group that allows TCP traffic on ephemeral ports (1024−655351024-65535) to the application tier's security group.
  4. D
    Create a new IAM role with the `iam:PassRole` permission to allow the database network interface to publish logs to CloudWatch Logs.
  5. E
    Add a route to the database subnet's route table targeting the Internet Gateway for destination CIDR 10.0.2.0/2410.0.2.0/24.

Cevap

To resolve the connectivity issue, the database subnet's Network ACL must be configured to allow the inbound traffic on port 54325432 from the application subnet, and allow the outbound return traffic on the ephemeral port range (1024−655351024-65535) to the application subnet.
The VPC Flow Logs entry shows an ingress packet from the application server (10.0.2.4510.0.2.45, source port 4915249152) to the database instance (10.0.3.8910.0.3.89, destination port 54325432) being rejected. Because the database instance's security group is already configured to allow this inbound traffic, the block is occurring at the database subnet's Network Access Control List (Network ACL). Since Network ACLs are stateless, rules must be configured explicitly for both inbound and outbound traffic. First, an inbound rule must be added to the database subnet's Network ACL to allow TCP traffic on port 54325432 from the application subnet CIDR (10.0.2.0/2410.0.2.0/24). Second, because the client initiated the connection using an ephemeral port (4915249152), an outbound rule must be added to the database subnet's Network ACL to allow the database's response traffic on the ephemeral port range (1024−655351024-65535) back to the application subnet.

Adım Adım Çözüm

1
Analyze the VPC Flow Log entry.
The log entry reveals that TCP traffic from 10.0.2.4510.0.2.45 (port 4915249152) to 10.0.3.8910.0.3.89 (port 54325432) is being rejected (`REJECT`) at the database interface level.
To determine where the connection is being blocked.
2
Identify the blocking security control.
Since the security group is already configured to permit the traffic, the block must be due to the database subnet's Network ACL.
To narrow down which configuration needs modification.
3
Apply stateless Network ACL rules.
Add an inbound Network ACL rule to allow TCP traffic on port 54325432 from the source subnet 10.0.2.0/2410.0.2.0/24. Add an outbound Network ACL rule to allow response traffic on the ephemeral port range (1024−655351024-65535) back to the destination subnet 10.0.2.0/2410.0.2.0/24.
Because Network ACLs are stateless, both ingress and egress paths must be explicitly permitted.

Anahtar Kavram

Stateless Network ACLs require explicit inbound and outbound rules for traffic flow, including allowing return traffic on ephemeral ports, whereas stateful Security Groups automatically allow return traffic.
Bu soruyu puanla

Konular

VPC Security Controls and Traffic Analysis

Bu konudan daha fazla soru