ANS-C01 Question 390
Select 3Your company hosts a multi-tier web application in an Amazon VPC. The application is experiencing intermittent connectivity issues between the web servers and the backend database servers. A network engineer suspects that the issue is related to security group rules or Network ACLs. What steps should you take to diagnose and resolve the issue?
- A
Check the security group rules associated with the web servers and ensure they allow outbound traffic to the database servers on the required port.
- B
Review the Network ACLs associated with the subnets of both the web servers and database servers to verify they allow traffic on the required port in both directions.
- C
Enable flow logs for the VPC and analyze the logs for rejected traffic between the web servers and database servers.
- D
Modify the database servers’ security group to allow inbound traffic from all IP addresses for testing purposes.
- E
Recreate the VPC and configure the components again to fix potential misconfigurations.
Show answer and explanation
Correct answers: A, B, C
Explanation
Intermittent connectivity issues between web servers and database servers in an Amazon VPC are often caused by misconfigurations in security group rules or Network ACLs. Diagnosing such issues involves verifying the security group and ACL rules for proper traffic permissions and analyzing VPC flow logs for rejected traffic data. Allowing unrestricted inbound traffic or recreating the VPC is not a best practice, as these solutions compromise security or introduce unnecessary complexity.
- A. Correct.
Correct: Outbound traffic from the web servers to the database servers must be explicitly allowed in the security group rules. Misconfigured rules could cause connectivity issues.
- B. Correct.
Correct: Network ACLs operate at the subnet level and could block traffic even if security group rules are correct. Verifying the ACL rules is essential.
- C. Correct.
Correct: VPC flow logs can provide insights into rejected traffic and help diagnose whether specific rules (security groups or ACLs) are causing the issue.
- D. Incorrect.
Incorrect: Allowing inbound traffic from all IP addresses is not a recommended practice, as it exposes the database to potential security risks. Testing should be done with specific, least-privilege rules.
- E. Incorrect.
Incorrect: Recreating the VPC is unnecessary and would cause significant downtime. Connectivity issues can usually be resolved by adjusting the existing configuration.