Examkin

Question

Difficulty: MediumAWS Network Services

A startup is deploying a two-tier application in a Virtual Private Cloud (VPC) with public and private subnets. The security team must enforce two controls: first, block specific malicious IP addresses from entering the public subnet entirely; second, allow stateful, bidirectional web traffic only on port 443 to the web servers. Which two AWS networking features or configurations should be used to satisfy these security requirements? (Select TWO.)

  1. A Network Access Control List (NACL) rule associated with the subnet to deny traffic from the malicious IP addressesAnswer
  2. A Security Group rule associated with the web server instances to allow inbound HTTPS trafficAnswer
  3. C
    A Security Group rule associated with the web server instances to deny inbound traffic from the malicious IP addresses
  4. D
    A Network Access Control List (NACL) rule associated with the web server instances to allow stateful return traffic
  5. E
    An AWS Transit Gateway configured to route and filter traffic between the subnets

Answer

A Network Access Control List (NACL) rule associated with the subnet to deny traffic from the malicious IP addresses, and a Security Group rule associated with the web server instances to allow inbound HTTPS traffic.
The correct options are a Network Access Control List (NACL) rule to deny traffic at the subnet boundary and a Security Group rule to allow HTTPS traffic at the instance level. NACLs allow explicit deny rules and apply at the subnet level, which blocks malicious traffic before it reaches any instances. Security Groups are stateful and operate at the instance level, allowing return traffic automatically once inbound access on port 443 is granted.

Step-by-Step Solution

1
Determine the control required to block specific malicious IP addresses at the subnet level.
Network ACLs are identified as the correct tool because they operate at the subnet boundary and support explicit deny rules.
Security Groups are allow-only and cannot explicitly deny specific IP addresses.
2
Determine the control required to permit stateful port 443 traffic to the web servers.
Security Groups associated with the instances are identified as the correct tool because they are stateful and allow inbound HTTPS traffic.
Security Groups automatically allow bidirectional return traffic, unlike Network ACLs which are stateless and would require explicit ephemeral port rules in both directions.

Key Concept

The difference between stateful Security Groups operating at the instance level and stateless Network Access Control Lists (NACLs) operating at the subnet level.
Rate this question

Topics

AWS Network Services

More questions from this topic