An application server in a custom VPC is deployed in Subnet App (CIDR: 192.168.10.0/24). I… — AWS Certified SysOps Administrator - Associate

An application server in a custom VPC is deployed in Subnet App (CIDR: $192.168.10.0/24$ ). It is configured to send log data via TCP to a self-managed log collector instance in Subnet Service (CIDR: $192.168.20.0/24$ ) on port $514$ . The security group for the log collector allows inbound TCP port $514$ traffic from Subnet App. The security group for the application server allows all outbound traffic. The Network Access Control Lists (NACLs) are configured as follows:

- Subnet App NACL:
- Inbound: Allow all traffic
- Outbound: Allow TCP port $514$ to Subnet Service ( $192.168.20.0/24$ )

- Subnet Service NACL:
- Inbound: Allow TCP port $514$ from Subnet App ( $192.168.10.0/24$ )
- Outbound: Allow TCP port $514$ to Subnet App ( $192.168.10.0/24$ )

The application server cannot successfully establish a connection to the log collector. Which configuration change is required to resolve this connectivity issue?

A
Modify the Network ACL of Subnet Service to allow outbound TCP traffic to Subnet App ( $192.168.10.0/24$ ) on port $514$ .
B
Do not make any changes to the Network ACLs because the security groups are stateful and will automatically allow the return traffic.
Add a rule to the Network ACL of Subnet Service to allow outbound TCP traffic to Subnet App ( $192.168.10.0/24$ ) on ports $1024-65535$ .Cevap
D
Modify the security group of the log collector instance to allow outbound TCP traffic to Subnet App ( $192.168.10.0/24$ ) on ports $1024-65535$ .

Cevap

Add a rule to the Network ACL of Subnet Service to allow outbound TCP traffic to Subnet App on ports 1024-65535.

The correct option is to add an outbound rule to the Subnet Service Network ACL to allow TCP traffic to Subnet App on ports 1024-65535. Network ACLs are stateless, meaning they evaluate traffic in each direction independently. The application server initiates a connection using an ephemeral port (1024-65535) as its source port. The response from the log collector is directed to that ephemeral port as the destination port. Therefore, the outbound NACL for Subnet Service must permit traffic to those ports.

Adım Adım Çözüm

Analyze the connection flow and ports.

The application server initiates a connection to the log collector. The request traffic travels from Subnet App (source port: ephemeral

1024-65535

) to Subnet Service (destination port:

514

Understanding the source and destination ports for both request and response paths is necessary to configure stateless rules.

Evaluate the stateful security group rules.

The security groups allow the flow. Since security groups are stateful, return traffic is automatically permitted by the security group once the inbound request is allowed.

Security groups do not block the return path due to their stateful nature.

Evaluate the stateless Network ACL (NACL) rules for the response path.

The response traffic travels from Subnet Service (source port:

514

) to Subnet App (destination port: ephemeral

1024-65535

). Currently, the outbound NACL for Subnet Service only allows outbound traffic with a destination port of

514

, which does not match the ephemeral ports.

NACLs are stateless and require explicit rules for both inbound request and outbound response paths.

Identify the required rule modification.

An outbound rule must be added to Subnet Service NACL allowing TCP traffic to Subnet App on ports

1024-65535

This rule matches the destination port range of the return traffic, allowing the connection to be established successfully.

Anahtar Kavram

Stateless Network ACLs require explicit configuration for return traffic targeting client ephemeral ports.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru