A cloud architect is designing the network security for a SaaS application's web servers running on Amazon EC2 instances in a VPC. To establish a defense-in-depth strategy, the architect plans to use both Security Groups and Network Access Control Lists (Network ACLs). Which of the following statements correctly describe the characteristics and differences between these two firewall layers? (Select TWO.)
- Security groups operate at the Amazon EC2 instance level, whereas Network ACLs operate at the subnet level.Answer
- BSecurity groups are stateless firewalls that inspect traffic at the subnet boundary, whereas Network ACLs are stateful firewalls that secure individual EC2 instances.
- Security groups are stateful, meaning return traffic is automatically allowed, whereas Network ACLs are stateless and require explicit outbound rules for return traffic.Answer
- DSecurity groups are managed entirely by AWS as part of the shared responsibility model, whereas Network ACLs must be configured by the customer.
- ESecurity groups use Amazon Inspector to scan active connections for vulnerabilities, whereas Network ACLs integrate with Amazon GuardDuty to block malicious IP addresses.
Answer
Security groups operate at the Amazon EC2 instance level and are stateful firewalls, while Network ACLs operate at the subnet level and are stateless firewalls.
Security groups are stateful firewalls operating at the instance level (ENI), allowing return traffic automatically without needing an explicit outbound rule. Network ACLs are stateless firewalls operating at the subnet level, requiring explicit rules for both inbound and outbound traffic paths.
Step-by-Step Solution
Key Concept
Understanding the architectural differences between Security Groups and Network ACLs, specifically focusing on their evaluation level (instance vs. subnet) and state tracking behavior (stateful vs. stateless).
Estimated Time:1m 30s