A company runs a microservices application where a payment processing service in Subnet Alpha () must make API calls to a verification service in Subnet Beta () on TCP port . A custom Network Access Control List (NACL) is associated with Subnet Alpha, while Subnet Beta uses the default VPC NACL. Security groups for both services are configured to allow the required traffic. However, connection attempts from Subnet Alpha to Subnet Beta on port are timing out.
Which configuration change must be made to the Subnet Alpha NACL to enable successful communication?
- Add an outbound rule to allow TCP port 8443 to Subnet Beta, and add an inbound rule to allow TCP ports 1024-65535 from Subnet Beta.Cevap
- BAdd an outbound rule to allow TCP port 8443 to Subnet Beta. No inbound rule is required in the Subnet Alpha NACL because security groups are stateful and track the connection.
- CAdd an outbound rule to allow TCP port 8443 to Subnet Beta, and add an inbound rule to allow TCP port 8443 from Subnet Beta.
- DAdd an inbound rule to allow TCP port 8443 from Subnet Beta, and add an outbound rule to allow TCP ports 1024-65535 to Subnet Beta.
Cevap
Add an outbound rule to allow TCP port 8443 to Subnet Beta, and add an inbound rule to allow TCP ports 1024-65535 from Subnet Beta.
Network Access Control Lists (NACLs) are stateless. To allow the payment processing service in Subnet Alpha to establish a connection with the verification service in Subnet Beta on port 8443, Subnet Alpha's NACL must permit outbound TCP traffic to Subnet Beta on port 8443 (for the request) and permit inbound TCP traffic from Subnet Beta on ports 1024-65535 (for the response to the client's ephemeral port).
Adım Adım Çözüm
Anahtar Kavram
Network Access Control Lists (NACLs) are stateless network filters that require explicit rules for both the request and response traffic paths, including the allocation of ephemeral ports for client connections.