A SysOps Administrator is hosting a public website on an Amazon EC2 instance within a VPC.… — AWS Certified SysOps Administrator - Associate

A SysOps Administrator is hosting a public website on an Amazon EC2 instance within a VPC. The instance is in a subnet with an associated route table that has a default route ( $0.0.0.0/0$ ) pointing to an Internet Gateway. The Security Group attached to the instance allows inbound TCP port $80$ traffic from all sources ( $0.0.0.0/0$ ) and allows all outbound traffic. The Administrator associates a custom Network Access Control List (NACL) with the subnet. The NACL allows inbound TCP port $80$ traffic from all sources ( $0.0.0.0/0$ ) and outbound TCP port $80$ traffic to all destinations ( $0.0.0.0/0$ ). Users report that they cannot connect to the website. Which of the following is the most likely cause of this issue?

A
The Security Group associated with the EC2 instance must be updated to allow outbound traffic to ephemeral ports ( $1024$ - $65535$ ) of the clients.
B
The route table associated with the subnet is missing a route for $0.0.0.0/0$ targeting the Internet Gateway.
The custom NACL outbound rules do not allow return traffic to the ephemeral port range ( $1024$ - $65535$ ) of the clients.Cevap
D
The subnet lacks a VPC Gateway Endpoint route configuration to direct return traffic to the clients.

Cevap

The custom NACL outbound rules do not allow return traffic to the ephemeral port range (

1024

65535

) of the clients.

The correct answer is correct because Network Access Control Lists (NACLs) are stateless. When a client initiates a connection to a web server, the source port on the client is an ephemeral port (typically

1024

65535

). Although the NACL allows inbound traffic on port

80

and outbound traffic on port

80

, the outbound response from the server is sent to the client's ephemeral port. Because the custom NACL does not have an outbound rule allowing traffic to the ephemeral port range, the return traffic is dropped.

Adım Adım Çözüm

Identify the statefulness of the firewalls involved.

Security Groups are stateful, meaning return traffic is automatically allowed. Network Access Control Lists (NACLs) are stateless, requiring explicit inbound and outbound rules for traffic flow.

To determine where the return traffic is being blocked in the network path.

Analyze the port requirements for the return traffic.

The client connects to port

80

(destination) from a random source port in the ephemeral range (

1024

65535

). The return traffic from the server will have a source port of

80

and a destination port in the ephemeral range (

1024

65535

To determine which port rules must be configured in the stateless NACL to allow return traffic.

Evaluate the custom NACL configuration against the port requirements.

The custom NACL only allows outbound traffic on TCP port

80

, which blocks the return traffic destined for the client's ephemeral ports.

To identify the root cause of the connection failure.

Anahtar Kavram

Stateless firewalls (NACLs) require explicit outbound rules for ephemeral ports to allow return traffic, whereas stateful firewalls (Security Groups) track connection states automatically.

Tahmini Süre:1m 30s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru