Examkin

Soru

Zorluk: OrtaVPC Flow Logs and Network Monitoring

An operations team reports that a critical application running on Amazon EC2 instances in a private subnet is unable to retrieve data from an external API, though the API endpoint is verified as active. To investigate the issue, a SysOps Administrator enables VPC Flow Logs for the subnet. The flow logs reveal that outbound TCP traffic to the API on port 443 shows an action of ACCEPT, but the inbound return traffic from the API's IP address on TCP ports 1024–65535 shows an action of REJECT. Which of the following is the most likely cause of this behavior?

  1. The network ACL associated with the subnet has an inbound rule that does not allow return traffic on ephemeral ports.Cevap
  2. B
    The security group associated with the EC2 instances lacks an inbound rule allowing return traffic from the API on the ephemeral port range.
  3. C
    The subnet's route table lacks a route for a Gateway VPC Endpoint, causing the response traffic to be dropped when routed back to the instances.
  4. D
    The IAM role used by the SysOps Administrator to enable the flow logs lacks the iam:PassRole permission.

Cevap

The network ACL associated with the subnet has an inbound rule that does not allow return traffic on ephemeral ports.
The correct answer is correct because network access control lists (NACLs) are stateless. Consequently, when an EC2 instance initiates an outbound connection, the return traffic is treated as a separate connection and must be explicitly allowed by the inbound NACL rules. Since the return traffic from the API uses ephemeral ports (1024–65535), the inbound NACL must allow this port range. If it does not, the traffic will be blocked and recorded as REJECT in the VPC Flow Logs.

Adım Adım Çözüm

1
Analyze the action logs for outbound and inbound traffic.
Outbound traffic is allowed (ACCEPT) on port 443, but inbound return traffic is blocked (REJECT) on ports 1024–65535.
This indicates that the outbound path is working but the return path is blocking the connection.
2
Evaluate the stateful nature of security groups.
Since security groups are stateful, return traffic for an initiated outbound connection is automatically allowed and would not show as REJECT.
This rules out security group misconfiguration as the cause of the REJECT action.
3
Evaluate the stateless nature of network ACLs.
Network ACLs are stateless, meaning outbound and inbound traffic must be evaluated independently. If the inbound network ACL rule does not allow return traffic on ephemeral ports, it will block the response.
This identifies the network ACL as the component blocking the return traffic and causing the REJECT action in the logs.

Anahtar Kavram

Stateless behavior of Network ACLs compared to stateful Security Groups in VPC Flow Logs
Bu soruyu puanla

Konular

VPC Flow Logs and Network Monitoring

Bu konudan daha fazla soru