Examkin

Question

Difficulty: HardAWS Network Services

A company has a single Virtual Private Cloud (VPC) containing a public subnet and a private subnet. The company needs to design a security and routing strategy that satisfies the following requirements:
1. Traffic from a list of specific, known malicious public IP addresses must be blocked from entering the public subnet.
2. Web servers in the public subnet must be allowed to initiate connections to database instances in the private subnet on port 3306, while all other inbound traffic to the database instances is restricted.

Which of the following configurations should the network administrator implement to meet these requirements? (Select TWO.)

  1. Create a Network Access Control List (NACL) associated with the public subnet with inbound rules that explicitly deny traffic from the malicious IP addresses.Answer
  2. B
    Create a Security Group for the web servers with inbound rules that explicitly deny traffic from the malicious IP addresses.
  3. Create a Security Group for the database instances that allows inbound traffic on port 3306 from the Security Group of the web servers.Answer
  4. D
    Create a Network Access Control List (NACL) associated with the public subnet that allows inbound traffic on port 3306 and relies on its stateful nature to automatically allow return database traffic.
  5. E
    Set up a VPC Peering connection between the public subnet and the private subnet to isolate and route the database traffic.

Answer

Implementing a Network Access Control List (NACL) to explicitly deny the malicious IP addresses at the public subnet level, and configuring a Security Group for the database instances to allow inbound traffic on port 3306 from the web servers' Security Group.
To block specific malicious IP addresses before they reach any resources, a Network Access Control List (NACL) must be configured with explicit DENY rules at the subnet boundary. To secure database instances, a Security Group must be created that allows inbound traffic on port 3306 from the web servers' Security Group. Security Groups are stateful and apply to instances, while NACLs are stateless and apply to subnets.

Step-by-Step Solution

1
Identify the mechanism needed to block traffic from specific external IP addresses.
A Network Access Control List (NACL) is selected because it operates at the subnet boundary and supports explicit DENY rules.
Security Groups only support ALLOW rules and cannot be configured to block specific IP addresses while permitting others.
2
Identify the mechanism needed to restrict database access to only the web servers on port 3306.
A Security Group is configured for the database instances, referencing the web servers' Security Group as the source for inbound port 3306 traffic.
Security Groups provide instance-level, stateful firewall protection and allow referencing other security groups to dynamically control access.
3
Evaluate the routing path between subnets in the same VPC.
Inter-subnet communication is handled automatically by the local route table of the VPC.
VPC Peering is intended to connect distinct VPCs and is not used to route traffic between subnets within a single VPC.

Key Concept

The primary differences between Security Groups (stateful, instance-level, ALLOW-only) and Network ACLs (stateless, subnet-level, ALLOW/DENY), and basic VPC subnet routing constraints.
Estimated Time:2m 0s
Rate this question

Topics

AWS Network Services

More questions from this topic