An EC2 instance with private IP address 10.0.1.50 is hosted in a private subnet and runs a… — AWS Certified SysOps Administrator - Associate

An EC2 instance with private IP address $10.0.1.50$ is hosted in a private subnet and runs an HTTPS service on TCP port $443$ . The instance is associated with a security group named `sg-secure` and the subnet is associated with a network ACL named `nacl-custom`.

An external client at IP address $198.51.100.5$ attempts to connect to the HTTPS service on the instance. A SysOps Administrator configures VPC Flow Logs to capture traffic on the instance's elastic network interface (ENI). The flow log output shows the following records:

text
version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status
2 123456789012 eni-0a1b2c3d4e5f6g7h8 198.51.100.5 10.0.1.50 49152 443 6 5 260 1601828400 1601828460 ACCEPT OK
2 123456789012 eni-0a1b2c3d4e5f6g7h8 10.0.1.50 198.51.100.5 443 49152 6 5 260 1601828400 1601828460 REJECT OK

The configuration of the security group `sg-secure` is:
- Inbound: Allow TCP port $443$ from $198.51.100.5/32$
- Outbound: Allow all traffic (destination $0.0.0.0/0$ , all ports)

The configuration of the network ACL `nacl-custom` is:
- Inbound:
- Rule 100: Allow TCP port $443$ from $0.0.0.0/0$
- Rule 32767: Deny all traffic
- Outbound:
- Rule 100: Allow TCP port $443$ to $0.0.0.0/0$
- Rule 32767: Deny all traffic

Which of the following changes will resolve the connectivity issue and allow the client to successfully establish a connection to the HTTPS service?

Add an outbound rule to the nacl-custom network ACL allowing TCP traffic with a destination port range of 1024-65535 to destination 0.0.0.0/0.Cevap
B
Add an outbound rule to the sg-secure security group allowing TCP traffic with a destination port of 49152 to destination 198.51.100.5/32.
C
Update the route table of the private subnet to add a route for 0.0.0.0/0 pointing directly to the Internet Gateway.
D
Modify the IAM role assigned to the VPC Flow Logs delivery service to grant the iam:PassRole permission for the Amazon CloudWatch Logs service.

Cevap

Add an outbound rule to the nacl-custom network ACL allowing TCP traffic with a destination port range of 1024-65535 to destination 0.0.0.0/0.

The correct answer is to add an outbound rule to the network ACL allowing TCP traffic with a destination port range of 1024-65535 to destination 0.0.0.0/0. Network ACLs are stateless, meaning they evaluate traffic in each direction independently. While the inbound rule allows port 443 traffic to enter, the outbound response traffic is sent from the server's port 443 to the client's ephemeral port (in this case, 49152). Because the outbound network ACL only allows destination port 443, the response packet is blocked by the default deny rule. Adding a rule for the ephemeral port range resolves this block.

Adım Adım Çözüm

Analyze the VPC Flow Log records to identify the source of the drop.

The log shows that inbound traffic (from 198.51.100.5:49152 to 10.0.1.50:443) is ACCEPT, but the outbound response (from 10.0.1.50:443 to 198.51.100.5:49152) is REJECT.

This establishes that routing is functional (since the request reached the ENI) and that the block is caused by a firewall configuration (Security Group or Network ACL) rather than routing.

Evaluate the statefulness of the Security Group.

Since Security Groups are stateful, they track connection state and automatically permit return traffic. Additionally, the security group has an outbound rule allowing all traffic.

This rules out the Security Group as the cause of the REJECT action on the outbound packet.

Evaluate the stateless nature and rules of the Network ACL.

Network ACLs are stateless, requiring explicit rules for both inbound and outbound traffic. The outbound NACL only allows destination port 443. The return traffic is sent from source port 443 to destination port 49152 (the client's ephemeral port).

Since 49152 does not match the rule allowing destination port 443, the packet is denied by the default Rule 32767 (Deny all traffic).

Determine the required resolution.

An outbound rule must be added to the Network ACL to allow traffic to the ephemeral port range (1024-65535) for return packets.

This permits the stateless response traffic to reach the client, completing the TCP handshake.

Anahtar Kavram

Stateless Network ACLs require explicit rules for return traffic targeting client ephemeral ports, whereas stateful Security Groups automatically allow return traffic.

Alternatif Yöntem

Alternatively, replacing the custom stateless Network ACL with the default Network ACL (which permits all inbound and outbound traffic) would resolve the block, though this represents a broader configuration change that reduces the custom subnet-level restrictions.

Tahmini Süre:3m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Alternatif Yöntem

Konular

Bu konudan daha fazla soru