Examkin

Soru

Zorluk: ZorNetwork Security Controls (Security Groups and NACLs)

A company is hosting a centralized monitoring server on an Amazon EC2 instance in Subnet A (172.31.1.0/24172.31.1.0/24). This server is configured to scrape metrics from production application servers located in Subnet B (172.31.2.0/24172.31.2.0/24) on TCP port 9100.

The custom Network Access Control List (NACL) for Subnet A has the following rules:
* Inbound: Allow TCP traffic on ports 1024−655351024-65535 from Subnet B (172.31.2.0/24172.31.2.0/24)
* Outbound: Allow TCP traffic on port 9100 to Subnet B (172.31.2.0/24172.31.2.0/24)

The custom NACL for Subnet B has the following rules:
* Inbound: Allow TCP traffic on port 9100 from Subnet A (172.31.1.0/24172.31.1.0/24)
* Outbound: Allow TCP traffic on port 9100 to Subnet A (172.31.1.0/24172.31.1.0/24)

The Security Groups associated with the EC2 instances are configured correctly to allow traffic on port 9100. However, the monitoring server cannot establish a connection to scrape metrics.

Which modification to the Subnet B NACL rules is required to resolve this connectivity issue?

  1. Modify the outbound rule for Subnet B to allow TCP traffic on ports 1024-65535 to Subnet A.Cevap
  2. B
    Modify the outbound rule for Subnet B to allow TCP traffic on port 9100 to Subnet A and enable stateful tracking in the NACL settings.
  3. C
    Modify the inbound rule for Subnet B to allow TCP traffic on ports 1024-65535 from Subnet A.
  4. D
    Remove the outbound rule in Subnet B entirely, as the stateful nature of the security groups will automatically permit the response traffic.

Cevap

Modify the outbound rule for Subnet B to allow TCP traffic on ports 1024-65535 to Subnet A.
The correct answer is to modify the outbound rule for Subnet B to allow TCP traffic on ports 1024-65535 to Subnet A. Because Network Access Control Lists (NACLs) are stateless, they evaluate inbound and outbound traffic independently. When the monitoring server in Subnet A initiates a connection to port 9100 on the application servers in Subnet B, the monitoring server uses a dynamically allocated ephemeral port (within the range 1024-65535) as the source port. The application server responds from port 9100 to that ephemeral destination port. Therefore, the outbound NACL rules for Subnet B must allow traffic on ports 1024-65535 to Subnet A in order for the response to pass through.

Adım Adım Çözüm

1
Analyze the direction of the connection initiation.
The connection is initiated by the monitoring server in Subnet A (IP range 172.31.1.0/24172.31.1.0/24) and targets port 9100 on the application servers in Subnet B (IP range 172.31.2.0/24172.31.2.0/24).
Understanding the source and destination is critical to diagnosing NACL issues.
2
Determine the ports used for the outbound request and response.
The request goes from Subnet A (source: ephemeral port 1024−655351024-65535) to Subnet B (destination: port 9100). The response goes from Subnet B (source: port 9100) back to Subnet A (destination: ephemeral port 1024−655351024-65535).
NACLs are stateless, meaning both request and response traffic must be explicitly allowed by separate rules.
3
Evaluate the current configuration of Subnet B's NACL rules.
Subnet B's inbound rules allow port 9100 from Subnet A, which is correct. However, Subnet B's outbound rules only allow port 9100 to Subnet A. This blocks the response traffic because it is destined for the client's ephemeral port range (1024−655351024-65535) instead of port 9100.
Identifying where the traffic is blocked points to the correct configuration change.
4
Formulate the required correction for Subnet B's NACL.
Change the outbound rule of Subnet B to allow TCP traffic on ports 1024−655351024-65535 targeting Subnet A.
This allows the application servers to send the metrics response back to the client's ephemeral ports.

Anahtar Kavram

NACLs are stateless, which requires outbound rules to explicitly permit return traffic to the client's ephemeral port range (typically 1024-65535).
Bu soruyu puanla

Konular

Network Security Controls (Security Groups and NACLs)

Bu konudan daha fazla soru