SOA-C02 · Question #197
A company website contains a web tier and a database tier on AWS. The web tier consists of Amazon EC2 instances that run in an Auto Scaling group across two Availability Zones. The database tier…
The correct answer is C. On the network ACLs for the database subnets, create an inbound Allow rule of type D. On the network ACLs for the database subnets, create an outbound Allow rule of type TCP with. Options C and D are correct because Network ACLs (NACLs) are stateless, meaning return traffic is never automatically allowed - you must explicitly permit both directions. When the third web subnet was added, the database subnet's restrictive NACL had no rule allowing inbound…
Question
A company website contains a web tier and a database tier on AWS. The web tier consists of Amazon EC2 instances that run in an Auto Scaling group across two Availability Zones. The database tier runs on an Amazon RDS for MySQL Multi-AZ DB instance. The database subnet network ACLs are restricted to only the web subnets that need access to the database. The web subnets use the default network ACL with the default rules. The company’s operations team has added a third subnet to the Auto Scaling group configuration. After an Auto Scaling event occurs, some users report that they intermittently receive an error message. The error messages states that the server cannot connect to the database. The operations team has confirmed that the route tables are correct and that the required ports are open on all security groups. Which combination of actions should a SysOps administrator take so that the web servers can communicate with the DB instance? (Choose two.)
Options
- AOn the default ACL, create inbound Allow rules of type TCP with the ephemeral port range and
- BOn the default ACL. Create outbound Allow rules of type MySQL/Aurora (3306). Specify the
- COn the network ACLs for the database subnets, create an inbound Allow rule of type
- DOn the network ACLs for the database subnets, create an outbound Allow rule of type TCP with
- EOn the network ACLs for the database subnets, create an outbound Allow rule of type
How the community answered
(22 responses)- A5% (1)
- B14% (3)
- C77% (17)
- E5% (1)
Explanation
Options C and D are correct because Network ACLs (NACLs) are stateless, meaning return traffic is never automatically allowed - you must explicitly permit both directions. When the third web subnet was added, the database subnet's restrictive NACL had no rule allowing inbound MySQL (port 3306) traffic from that new subnet's CIDR (C), and no outbound rule permitting return traffic back to web clients on ephemeral ports 1024–65535 (D). Security groups handled their part correctly, but NACLs operate at the subnet boundary and block traffic independently.
A and B are wrong because the web subnets use the default NACL, which already contains a catch-all ALLOW ALL rule for both inbound and outbound traffic - adding rules there is redundant and solves nothing. E is wrong because outbound traffic leaving the database subnet back to the web tier uses ephemeral/dynamic ports (1024–65535), not port 3306; port 3306 is only for inbound connections to MySQL.
Memory tip: Use the mantra "NACLs are stateless - two-way or no way." Whenever a NACL is involved, always ask yourself: did I write rules for both the request and the response? If security groups work but connections still fail, the culprit is almost always a missing return-direction NACL rule on ephemeral ports.
Topics
Community Discussion
No community discussion yet for this question.