Exam AWS Certified Security - Specialty topic 1 question 260 discussion

B: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#nacl-ephemeral-ports Ensure that you place the deny rules earlier in the table than the allow rules that open the wide range of ephemeral ports.

All answers are wrong. A: inbound rules are ok, outbound doesn't allow 1024-65535. B: Inbound allows 1024-65535 C: Inbound allows 1024-65535 D: Duplicate of A. The correct answer should allow 443 inbound, deny 3306 inbound, and allow 1024-65535 outbound.

Correct answer is B.

B. Check "Ephemeral ports" in https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

B is correct answer If an instance in your VPC is the client initiating a request, your network ACL must have an inbound rule to enable traffic destined for the ephemeral ports specific to the type of instance (Amazon Linux, Windows Server 2008, and so on). https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#nacl-ephemeral-ports

the choice B is correct I think, but the answer is just worded in a weird manner. The internal host is the source trying to go out so outbound on 443 port and needs to return on inbound port 1024-65535

The correct answer is D. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port 443. Use outbound rule 100 to allow traffic on TCP port 443. This rule set denies all inbound traffic destined for MySQL port 3306 while allowing all outbound traffic to the internet service that uses TLS through port 443, and also allowing all outbound traffic.

If we knew that the only port is gonna be used is 443, why couldn't it be inbound/outbound 443 only? The network ACL rule set that meets these requirements is D. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port 443. Use outbound rule 100 to allow traffic on TCP port 443. This will block any inbound traffic to MySQL port 3306 and allow outbound traffic to the internet service that uses TLS through port 443.

selected B

The solution must allow outbound traffic to an internet service that uses TLS through port 443.

B is correct

D - Probably because allowing inbound on 1024-65535 will not sit in line with security hardening. Better to allow only 443 inbound rather than allowing the entire ephemeral port range

A - Inbound need ephemeral ports 1024~65535 for return traffic of the outbound 443 port traffic, B - Good one C - rule 200 will not be evaluated and traffic to 3306 is not blocked. D - same as A

B: inbound: 100 deny port 3306 (you deny SQL) 200 Allow port 1024-65535 (you allow the reply back traffic) Outbound: 100 permit port 443 (Allow out https)

B!!!!!!!!!!!!!!!!

Deny first, allow second. Lease privilege so you cant allow all of those inbound ports, ephemeral should be for outbound only.

Easily B