Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

A cloud architect needs to implement a network security control that operates at the subnet level to block traffic from a list of known malicious IP addresses before it reaches any EC2 instances. The control must evaluate traffic as it enters and leaves the subnet boundary, and any returned response traffic must be explicitly permitted by a rule because the control does not automatically remember connection states. Which AWS resource should the architect configure?

  1. A
    Security Groups
  2. Network Access Control Lists (Network ACLs)Answer
  3. C
    Amazon GuardDuty
  4. D
    AWS CloudTrail

Answer

Network Access Control Lists (Network ACLs)
Network Access Control Lists (Network ACLs) are stateless firewalls that operate at the subnet level. They require rules to be configured for both inbound and outbound traffic because they do not track connection states.

Step-by-Step Solution

1
Identify the boundary level at which the firewall control must operate.
The requirement specifies the control must operate at the subnet level.
This helps narrow down the choices between instance-level controls and subnet-level controls.
2
Analyze the stateful or stateless behavior required for the firewall rules.
The control must evaluate traffic in both directions and does not automatically track connection states, requiring explicit return rules (stateless behavior).
This confirms that Network ACLs must be used, as they are stateless and operate at the subnet boundary, whereas Security Groups are stateful and operate at the instance level.

Key Concept

Understanding the differences in scope and state management between Security Groups and Network ACLs.
Estimated Time:1m 0s
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic