Examkin

Question

Difficulty: EasyNetwork and Infrastructure Security

An administrator needs to configure a network access control list (network ACL) to allow inbound traffic on a specific port to a subnet. Which of the following actions is also required to allow response traffic back to the client?

  1. Add a corresponding outbound rule in the network ACL to allow the return traffic.Answer
  2. B
    Do nothing, because the network ACL is stateful and will automatically allow the response traffic.
  3. C
    Submit a request to AWS Support to configure the return route under the AWS Shared Responsibility Model.
  4. D
    Enable Amazon GuardDuty to monitor the port and dynamically permit the response traffic.

Answer

Add a corresponding outbound rule in the network ACL to allow the return traffic.
Network ACLs operate at the subnet level and are stateless. This means they do not keep track of session states. If you define a rule to allow inbound traffic, you must also define a corresponding rule to allow the outbound response traffic back to the client.

Step-by-Step Solution

1
Identify the security control being configured.
The control is a Network Access Control List (network ACL) operating at the subnet boundary.
Determining the security control type helps identify whether the rule evaluation is stateful or stateless.
2
Apply the stateless rule logic of Network ACLs.
Since Network ACLs are stateless, allowing inbound traffic on a port does not automatically allow outbound responses on that port.
Stateless firewalls evaluate traffic in each direction independently.
3
Define the missing configuration required for communication.
An outbound rule allowing response traffic back to the client must be added to the network ACL.
Both inbound and outbound rules are necessary to enable complete two-way network communications.

Key Concept

Network ACLs are stateless security controls that evaluate inbound and outbound traffic independently, requiring manual rule configuration in both directions.
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic