Examkin

Soru

Zorluk: KolayVPC Security Controls and Traffic Analysis

A SysOps Administrator is hosting a public website on an Amazon EC2 instance within a custom VPC. The Security Group associated with the EC2 instance allows all outbound traffic and inbound HTTP traffic on port 80. The Network ACL (NACL) associated with the subnet has an inbound rule that allows HTTP traffic on TCP port 80 from 0.0.0.0/0. However, external users cannot connect to the website. Which configuration change is required to allow external traffic to reach the web server?

  1. A
    Configure an outbound rule in the Network ACL that allows TCP traffic on port 80 to destination 0.0.0.0/0.
  2. Add an outbound rule to the Network ACL that allows TCP traffic on ports 1024-65535 to destination 0.0.0.0/0.Cevap
  3. C
    Add an outbound rule to the Security Group that allows TCP traffic on ports 1024-65535 to destination 0.0.0.0/0.
  4. D
    Create a Gateway VPC Endpoint for the subnet and associate it with the subnet's route table.

Cevap

Add an outbound rule to the Network ACL that allows TCP traffic on ports 1024-65535 to destination 0.0.0.0/0.
The correct answer provides the necessary outbound rule for the stateless Network ACL. Since Network ACLs do not track connection states, return traffic from the web server back to the web clients must be explicitly permitted. Web clients initiate HTTP requests using random source ports from the ephemeral port range (TCP 1024-65535), meaning the return traffic must be allowed to leave the subnet on these ports.

Adım Adım Çözüm

1
Evaluate the stateful or stateless properties of the subnet's security controls.
The Security Group is stateful, while the Network ACL is stateless.
Because the Network ACL is stateless, any allowed inbound request must also have a corresponding outbound rule configured to allow the return traffic back to the client.
2
Determine the destination ports for the return traffic.
The return traffic targets the client's client-side source ports, which fall in the ephemeral port range (TCP 1024-65535).
Web browsers initiate connections using random ports in the ephemeral range rather than the service port (80).
3
Apply the outbound rule to permit return traffic through the Network ACL.
An outbound rule allowing TCP traffic on ports 1024-65535 to 0.0.0.0/0 is configured on the custom Network ACL.
This configuration allows packets originating from the EC2 instance's web server to exit the subnet back to the public internet client.

Anahtar Kavram

Network ACLs (NACLs) are stateless firewalls that control inbound and outbound traffic at the subnet level. They require explicit configuration of outbound rules for ephemeral port ranges (1024-65535) to allow response traffic back to clients.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

VPC Security Controls and Traffic Analysis

Bu konudan daha fazla soru