Examkin

Question

Difficulty: EasyAWS Network Services

A cloud practitioner needs to configure a network security control that operates at the subnet level of an Amazon VPC to block traffic from a specific IP address. Which AWS service or feature should be used to meet this requirement?

  1. A
    Security Group
  2. Network Access Control List (Network ACL)Answer
  3. C
    VPC Peering connection
  4. D
    Amazon GuardDuty

Answer

Network Access Control List (Network ACL)
The correct answer is the Network Access Control List (Network ACL). A Network ACL is a stateless firewall that operates at the subnet boundary of an Amazon VPC. It supports both allow rules and deny rules, which allows a cloud practitioner to explicitly define a rule that blocks inbound or outbound traffic from a specific IP address.

Step-by-Step Solution

1
Analyze the operational boundary requirement in the scenario.
The firewall or security control must operate at the subnet level.
The requirement specifies blocking traffic at the subnet boundary of an Amazon VPC.
2
Determine the rule behavior needed to block a specific IP address.
The control must support explicit deny rules.
Blocking an IP address requires a firewall that can evaluate and reject traffic from that specific address.
3
Evaluate the capabilities of Amazon VPC security features.
Network Access Control Lists (Network ACLs) operate at the subnet level and support both allow and deny rules, while security groups operate at the instance level and only support allow rules.
This makes Network ACLs the correct tool for blocking specific IP addresses at the subnet boundary.

Key Concept

Subnet-level network security in AWS using Network Access Control Lists (Network ACLs)
Estimated Time:45s
Rate this question

Topics

AWS Network Services

More questions from this topic