AWS Certified Solutions Architect Professional · Free Practice Question Medium
Question 16
A secure web application runs in an Amazon VPC that has a public subnet and a private subnet. An Application Load Balancer is deployed into the public subnet. Each subnet has a separate Network ACL. The public subnet CIDR range is 10.1.0.0/24 and the private subnet CIDR range is 10.1.1.0/24. The web application is deployed on Amazon EC2 instances in the private subnet. Which combination of rules should be defined on the private subnet’s Network ACL to allow access from internet-based clients?
(Select TWO.)
-
A
An outbound rule for port 443 to destination 10.1.0.0/24.
-
B
An inbound rule for port 443 from source 0.0.0.0/0.
-
C
An outbound rule for ports 1024 through 65535 to destination 10.1.0.0/24.
-
D
An inbound rule for port 443 from source 10.1.0.0/24.
-
E
An outbound rule for port 443 to destination 0.0.0.0/0.
Reveal correct answers
Correct answers: C, D
Explanation
Network ACLs are stateless firewalls. This means you must define rules for the inbound and outbound connections. In this case the source address of packets coming towards the instances will be the IP addresses of the ALB nodes in 10.1.0.0/24. An inbound rule allowing 443 from this source network should be created.
The outbound connection will be made to the source port of the ALB node which is a dynamically defined high number port between 1024 and 65535. Therefore, an outbound rule must be created that allows this port range to destination 10.1.0.0/24.
CORRECT: "An inbound rule for port 443 from source 10.1.0.0/24." is a correct answer.
CORRECT: "An outbound rule for ports 1024 through 65535 to destination 10.1.0.0/24." is also a correct answer.
INCORRECT: "An inbound rule for port 443 from source 0.0.0.0/0." is incorrect. This would allow any source IP range but should be locked down to the ALB nodes in 10.1.0.0/24
INCORRECT: "An outbound rule for port 443 to destination 0.0.0.0/0." is incorrect. The outbound connection will not have a destination port of 443, the destination port will be a high numbered port between 1024 and 65535.
INCORRECT: "An outbound rule for port 443 to destination 10.1.0.0/24." is incorrect. The outbound connection will not have a destination port of 443, the destination port will be a high numbered port between 1024 and 65535.
References:
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
