Examkin

Soru

Zorluk: OrtaNetwork Security Controls (Security Groups and NACLs)

An enterprise monitoring system runs on an Amazon EC2 instance in Subnet Management (10.50.10.0/2410.50.10.0/24). It needs to scrape metrics from a Node Exporter service running on EC2 instances in Subnet Production (10.50.20.0/2410.50.20.0/24) on custom TCP port 91009100. Subnet Production is associated with a custom Network Access Control List (NACL) that currently blocks all inbound and outbound traffic by default.

Which combination of rules must be added to the Subnet Production NACL to allow the monitoring server to scrape metrics? (Select TWO.)

  1. An inbound rule allowing TCP traffic from 10.50.10.0/2410.50.10.0/24 on destination port 91009100Cevap
  2. An outbound rule allowing TCP traffic to 10.50.10.0/2410.50.10.0/24 on destination ports 1024−655351024-65535Cevap
  3. C
    An outbound rule allowing TCP traffic to 10.50.10.0/2410.50.10.0/24 on destination port 91009100
  4. D
    An inbound rule allowing TCP traffic from 10.50.10.0/2410.50.10.0/24 on destination ports 1024−655351024-65535
  5. E
    No outbound rules are required because Network Access Control Lists (NACLs) are stateful and automatically allow return traffic

Cevap

The correct combination of rules requires an inbound rule allowing TCP traffic from the Management subnet on destination port 91009100, and an outbound rule allowing TCP traffic to the Management subnet on destination ports 1024−655351024-65535.
The correct combination consists of an inbound rule allowing TCP traffic from 10.50.10.0/2410.50.10.0/24 on destination port 91009100 and an outbound rule allowing TCP traffic to 10.50.10.0/2410.50.10.0/24 on destination ports 1024−655351024-65535. The inbound rule is necessary because the monitoring client initiates a request to the Node Exporter on port 91009100. The outbound rule is necessary because NACLs are stateless, meaning return traffic must be explicitly permitted. Response packets are sent back to the client's ephemeral port range (1024−655351024-65535).

Adım Adım Çözüm

1
Analyze the direction and ports of the initial request.
The monitoring server in Subnet Management (10.50.10.0/2410.50.10.0/24) initiates a connection to the Node Exporter in Subnet Production (10.50.20.0/2410.50.20.0/24) on destination port 91009100. This requires an inbound rule in the Production subnet's NACL to permit TCP traffic from 10.50.10.0/2410.50.10.0/24 on port 91009100.
NACL rules are applied at the subnet boundary and must permit traffic entering the subnet.
2
Determine the return path port requirements.
The client (monitoring server) uses a random ephemeral port (typically 1024−655351024-65535) as the source port for the request. When the Node Exporter replies, the response packets will have the destination port set to this ephemeral port.
Standard TCP client-server communication uses client-side ephemeral ports for return traffic.
3
Configure the stateless outbound rule.
Because NACLs are stateless and do not automatically track connections, an outbound rule must be added to the Production subnet's NACL allowing TCP traffic to 10.50.10.0/2410.50.10.0/24 on destination ports 1024−655351024-65535.
Outbound return traffic would otherwise be dropped by the default deny rule of the stateless NACL.

Anahtar Kavram

Network Access Control Lists (NACLs) are stateless packet filters that require explicit rules for both inbound and outbound traffic directions, including ephemeral ports for response traffic.
Bu soruyu puanla

Konular

Network Security Controls (Security Groups and NACLs)

Bu konudan daha fazla soru