Which set of network ACL changes will increase the security of the application while ensuring functionality?
Make the following changes to NACL3:Add a rule that allows inbound traffic on port 5432 from NACL2.Add a rule that allows outbound traffic on ports 1024-65536 to NACL2.Remove the default rules that allow all inbound and outbound traffic.
Make the following changes to NACL3:Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the application instance subnets.Add a rule that allows outbound traffic on ports 1024-65536 to the application instance subnets.Remove the default rules that allow all inbound and outbound traffic.
Make the following changes to NACL2:Add a rule that allows outbound traffic on port 5432 to the CIDR blocks of the RDS subnets.Remove the default rules that allow all inbound and outbound traffic.
Make the following changes to NACL2:Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the RDS subnets.Add a rule that allows outbound traffic on port 5432 to the RDS subnets.
Explanations:
Allows correct inbound and outbound traffic to the DB but unnecessarily restricts ephemeral ports for responses.
Enables inbound port 5432 access only from application subnets and restricts outbound ports appropriately.
Controls outbound traffic to the DB, but does not secure inbound traffic to RDS on port 5432 from application.
Incorrectly configures NACL2 to allow inbound 5432 traffic, which is not necessary for application subnets.
It seems to me that the answer is:
Make the following changes to NACL3:Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the application instance subnets.Add a rule that allows outbound traffic on ports 1024-65536 to the application instance subnets.Remove the default rules that allow all inbound and outbound traffic.