A company is hosting a multi-tier web application in an Amazon Virtual Private Cloud (Amaz… — AWS Certified Cloud Practitioner

A company is hosting a multi-tier web application in an Amazon Virtual Private Cloud (Amazon VPC). The security team has identified a range of malicious IP addresses, $198.51.100.0/22$ , that must be blocked from accessing the application. Additionally, the web servers must only accept inbound traffic on TCP ports $80$ and $443$ , and the return traffic to the clients must be allowed automatically without configuring any additional outbound rules. Which combination of AWS network security features will meet these requirements?

A
A stateful Security Group at the instance level to deny traffic from $198.51.100.0/22$ , and a stateless Network Access Control List (Network ACL) at the subnet level to allow inbound traffic on TCP ports $80$ and $443$ .
B
A stateful Security Group at the subnet level to deny traffic from $198.51.100.0/22$ , and an AWS Transit Gateway route table to restrict access to TCP ports $80$ and $443$ .
A stateless Network Access Control List (Network ACL) at the subnet level to deny traffic from $198.51.100.0/22$ , and a stateful Security Group at the instance level to allow inbound traffic on TCP ports $80$ and $443$ .Answer
D
A stateless Network Access Control List (Network ACL) at the instance level to allow traffic on TCP ports $80$ and $443$ , and a custom route table associated with the Internet Gateway to deny traffic from $198.51.100.0/22$ .

Answer

A stateless Network Access Control List (Network ACL) at the subnet level to deny traffic from the malicious IP range, and a stateful Security Group at the instance level to allow inbound traffic on TCP ports

80

and

443

A stateless Network ACL operates at the subnet level and supports explicit deny rules, which allows it to block the malicious CIDR range (

198.51.100.0/22

) before traffic reaches any EC2 instances. A stateful Security Group operates at the instance level and automatically tracks connection states, ensuring that inbound traffic allowed on TCP ports

80

and

443

can receive return traffic without requiring explicit outbound configuration.

Step-by-Step Solution

Evaluate the requirement to block the malicious CIDR block

198.51.100.0/22

Determine that Network ACLs support both allow and deny rules, whereas Security Groups only support allow rules.

An explicit deny rule is required to block specific IP addresses, which can only be configured in a Network ACL.

Evaluate the requirement to allow inbound traffic on TCP ports

80

and

443

and automatically permit return traffic.

Determine that Security Groups are stateful, meaning return traffic is automatically allowed, whereas Network ACLs are stateless and require explicit outbound rules for return traffic.

Using a stateful Security Group satisfies the requirement of allowing return traffic automatically without additional outbound configuration.

Determine the correct deployment boundary for each security feature.

Verify that Network ACLs are applied at the subnet level, while Security Groups are applied at the elastic network interface (instance) level.

This configuration correctly blocks malicious traffic at the subnet boundary before it reaches the instances, and applies granular access controls on the instances themselves.

Key Concept

The operational differences and use cases for stateful Security Groups and stateless Network ACLs within an Amazon VPC.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic