Examkin

Question

Difficulty: MediumAWS Network Services

An organization is designing a security strategy for its Amazon Virtual Private Cloud (Amazon VPC) to defend against network-level attacks. The security team requires a stateless traffic filtering mechanism that can evaluate rules at the boundary of a subnet. Which Amazon VPC feature should the security team implement to satisfy this requirement?

  1. A
    Security Groups
  2. Network Access Control ListsAnswer
  3. C
    Route Tables
  4. D
    Transit Gateways

Answer

Network Access Control Lists
Network Access Control Lists (NACLs) act as a firewall for associated subnets, controlling both inbound and outbound traffic at the subnet boundary. They are stateless, meaning that return traffic must be explicitly allowed by rules.

Step-by-Step Solution

1
Analyze the requirements in the scenario: the firewall mechanism must be 'stateless' and operate at the 'subnet boundary'.
Identified key constraints: stateless filtering and subnet-level placement.
This narrows down the AWS networking features to those operating at the subnet level rather than the instance level.
2
Compare the features of Security Groups and Network Access Control Lists (NACLs).
Security Groups are stateful and operate at the instance level, whereas Network Access Control Lists (NACLs) are stateless and operate at the subnet level.
Since the requirement specifies stateless filtering at the subnet boundary, Network Access Control Lists are the correct choice.

Key Concept

Understanding the difference between stateful instance-level security groups and stateless subnet-level Network Access Control Lists (NACLs).
Rate this question

Topics

AWS Network Services

More questions from this topic