Examkin

Soru

Zorluk: OrtaVPC Security Controls and Traffic Analysis

A SysOps Administrator is troubleshooting a connectivity issue between an Application Load Balancer (ALB) in a public subnet (10.0.1.0/2410.0.1.0/24) and a fleet of web servers running on Amazon EC2 instances in a private subnet (10.0.2.0/2410.0.2.0/24). Users are reporting HTTP 504504 Gateway Timeout errors when attempting to access the application.

The Administrator reviews the VPC Flow Logs for the web servers' subnet and observes the following entries:

versionsrcaddrdstaddrsrcportdstportprotocolpacketsbytesactionlog-status
210.0.1.5010.0.2.1051243806140ACCEPTOK
210.0.2.1010.0.1.5080512436140REJECTOK

What configuration change is required to resolve this connectivity issue?

  1. Add an outbound rule to the Network ACL associated with the private subnet to allow outbound traffic to the public subnet (10.0.1.0/2410.0.1.0/24) on ephemeral ports (1024−655351024-65535).Cevap
  2. B
    Add an outbound rule to the security group associated with the web server instances to allow outbound traffic to the public subnet (10.0.1.0/2410.0.1.0/24) on ephemeral ports (1024−655351024-65535).
  3. C
    Add an outbound route in the private subnet's route table targeting the Internet Gateway (IGWIGW) for the destination range (10.0.1.0/2410.0.1.0/24).
  4. D
    Associate a Gateway VPC Endpoint with the private subnet's route table to allow direct routing of response traffic to the public subnet.

Cevap

Add an outbound rule to the Network ACL associated with the private subnet to allow outbound traffic to the public subnet (10.0.1.0/2410.0.1.0/24) on ephemeral ports (1024−655351024-65535).
The VPC Flow Logs reveal that inbound traffic from the ALB (10.0.1.5010.0.1.50) to the web server (10.0.2.1010.0.2.10) is accepted, but the outbound response is rejected. Because Security Groups are stateful, they automatically allow response traffic for any permitted inbound connection. However, Network ACLs are stateless and require explicit rules in both directions. The rejection of the outbound response indicates that the private subnet's Network ACL is missing an outbound rule. The rule must permit outbound traffic to the ephemeral ports (1024−655351024-65535) used by the ALB to receive the response.

Adım Adım Çözüm

1
Analyze the VPC Flow Logs to determine the status of the connection.
The log shows that the inbound HTTP request (destination port 8080, source port 5124351243) from the ALB (10.0.1.5010.0.1.50) to the web server (10.0.2.1010.0.2.10) is accepted, but the outbound response (source port 8080, destination port 5124351243) is rejected.
Identifying that the request is accepted but the response is rejected helps isolate the issue to a stateless security control.
2
Evaluate the stateful/stateless nature of the security controls.
Security groups are stateful and automatically allow response traffic, meaning they are not causing the outbound rejection. Network ACLs are stateless and require explicit rules in both directions.
Since the inbound request was accepted, a stateless control like a Network ACL must be blocking the return traffic due to a missing outbound rule.
3
Determine the necessary configuration change.
Add an outbound rule to the private subnet's Network ACL to allow traffic to the public subnet (10.0.1.0/2410.0.1.0/24) on ephemeral ports (1024−655351024-65535).
The client connection uses ephemeral ports for response traffic. Explicitly allowing outbound traffic on ephemeral ports completes the response loop.

Anahtar Kavram

VPC Network ACLs are stateless security controls that evaluate inbound and outbound traffic independently. Allowed inbound connections require matching outbound rules for the ephemeral port range (1024−655351024-65535) to successfully return response traffic.
Bu soruyu puanla

Konular

VPC Security Controls and Traffic Analysis

Bu konudan daha fazla soru