Topic 1 Question 276
2 つ選択A company website contains a web tier and a database tier on AWS. The web tier consists of Amazon EC2 instances that run in an Auto Scaling group across two Availability Zones. The database tier runs on an Amazon RDS for MySQL Multi-AZ DB instance. The database subnet network ACLs are restricted to only the web subnets that need access to the database. The web subnets use the default network ACL with the default rules.
The company's operations team has added a third subnet to the Auto Scaling group configuration. After an Auto Scaling event occurs, some users report that they intermittently receive an error message. The error message states that the server cannot connect to the database. The operations team has confirmed that the route tables are correct and that the required ports are open on all security groups.
Which combination of actions should a SysOps administrator take so that the web servers can communicate with the DB instance?
On the default ACL, create inbound Allow rules of type TCP with the ephemeral port range and the source as the database subnets.
On the default ACL, create outbound Allow rules of type MySQL/Aurora (3306). Specify the destinations as the database subnets.
On the network ACLs for the database subnets, create an inbound Allow rule of type MySQL/Aurora (3306). Specify the source as the third web subnet.
On the network ACLs for the database subnets, create an outbound Allow rule of type TCP with the ephemeral port range and the destination as the third web subnet.
On the network ACLs for the database subnets, create an outbound Allow rule of type MySQL/Aurora (3306). Specify the destination as the third web subnet.
ユーザの投票
コメント(1)
- 正解だと思う選択肢: CD
The simplified logic I came up with is if the same existing/working public NACL is applied to the new pub subnet, then no change should need to be made to the rules. On the other hand, the custom DB subnet NACL needs to have new incoming/outgoing rules to also operate with the new public subnet. Incoming is always going to be 3306 to the DB listener (MySQL). Outgoing is always going to be ephemeral from the DB server to public subnet. I must be slow or tired, but It took some effort for this to become clear in my mind tonight. Your only allowing an existing subnet, and you don't want to touch any existing configurations or your going to create a new problem and maybe be looking for a new job. I'd always document a checklist before doing something this, and run it through peer review and change control before touching prod. I'd turn those notes into a SOP and include any references I could fine documenting AWS best practices, etc. Enough said.
👍 5Gomer2023/05/01
シャッフルモード