Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

A digital publishing company hosts its content management system on Amazon Elastic Compute Cloud (Amazon EC2) instances within a public subnet. Following a security audit, the team needs to implement a rule that blocks a specific list of malicious IP addresses from reaching any resources within that subnet. Additionally, the security team notes that the control must evaluate both inbound and outbound traffic separately since it does not automatically track connection states. Which AWS resource should the company configure to meet these requirements?

  1. Network Access Control Lists (Network ACLs)Answer
  2. B
    Security Groups
  3. C
    AWS Shield Standard
  4. D
    Amazon GuardDuty

Answer

Network Access Control Lists (Network ACLs)
The correct answer is Network Access Control Lists (Network ACLs). Network ACLs act as a stateless firewall at the subnet level. They support both allow and deny rules (enabling the block of specific IP addresses) and require separate configuration for inbound and outbound traffic because they do not track connection states.

Step-by-Step Solution

1
Analyze the requirement for blocking traffic at the subnet level.
The solution must operate at the subnet boundary to protect all resources within the subnet, ruling out instance-level controls.
Security Groups operate at the instance level, whereas Network ACLs operate at the subnet level.
2
Evaluate the requirement for blocking specific IP addresses (explicit deny).
The service must support deny rules.
Security Groups only support allow rules, meaning you cannot explicitly deny specific IP addresses. Network ACLs support both allow and deny rules.
3
Verify the connection tracking requirement (stateless vs. stateful).
The control must evaluate inbound and outbound traffic separately because it does not track connection states (stateless).
Network ACLs are stateless, requiring explicit configuration of inbound and outbound rules, which matches the scenario's requirements.

Key Concept

Stateful vs. Stateless AWS Firewall Features at Subnet and Instance Levels
Estimated Time:1m 30s
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic