SOA-C02 · Question #663
A company website contains a web tier and a database tier on AWS. The web tier consists of Amazon EC2 instances that run in an Auto Scaling group across two Availability Zones. The database tier…
The correct answer is C. On the network ACLs for the database subnets, create an inbound Allow rule of type D. On the network ACLs for the database subnets, create an outbound Allow rule of type TCP with. The issue arises because the database subnet network ACLs were originally configured to allow access only from the existing web subnets, but a new third web subnet was added. Since network ACLs (NACLs) are stateless, both inbound and outbound rules must be explicitly allowed…
Question
A company website contains a web tier and a database tier on AWS. The web tier consists of Amazon EC2 instances that run in an Auto Scaling group across two Availability Zones. The database tier runs on an Amazon RDS for MySQL Multi-AZ DB instance. The database subnet network ACLs are restricted to only the web subnets that need access to the database. The web subnets use the default network ACL with the default rules. The company's operations team has added a third subnet to the Auto Scaling group configuration. After an Auto Scaling event occurs, some users report that they intermittently receive an error message. The error message states that the server cannot connect to the database. The operations team has confirmed that the route tables are correct and that the required ports are open on all security groups. Which combination of actions should a SysOps administrator take so that the web servers can communicate with the DB instance? (Choose two.)
Options
- AOn the default ACL, create inbound Allow rules of type TCP with the ephemeral port range and
- BOn the default ACL, create outbound Allow rules of type MySQL/Aurora (3306). Specify the
- COn the network ACLs for the database subnets, create an inbound Allow rule of type
- DOn the network ACLs for the database subnets, create an outbound Allow rule of type TCP with
- EOn the network ACLs for the database subnets, create an outbound Allow rule of type
How the community answered
(40 responses)- A10% (4)
- B3% (1)
- C83% (33)
- E5% (2)
Explanation
The issue arises because the database subnet network ACLs were originally configured to allow access only from the existing web subnets, but a new third web subnet was added. Since network ACLs (NACLs) are stateless, both inbound and outbound rules must be explicitly allowed for two- way communication. The database subnet NACL must allow inbound traffic on MySQL/Aurora port 3306 from the newly added third web subnet. This allows the web servers in that subnet to initiate a connection to the RDS instance. Since NACLs are stateless, an outbound rule is required to allow the database response traffic back to the third web subnet. MySQL/Aurora responses typically use ephemeral ports (1024?5535), so this rule must allow outbound TCP traffic to those ports in the third web subnet.
Topics
Community Discussion
No community discussion yet for this question.