Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

A company is hosting a virtual classroom platform with video processing workloads on Amazon EC2 instances inside a private subnet. The security team wants to implement a multi-layered security approach: they need to block a specific range of malicious external IP addresses at the subnet boundary, and they must allow administrative SSH traffic to the instances from a designated bastion host while ensuring that the return traffic is automatically permitted. Which TWO of the following configurations should the team implement?

  1. Add an inbound deny rule for the malicious IP range to the Network Access Control List (Network ACL) associated with the subnetAnswer
  2. Add an inbound allow rule for SSH from the bastion host IP address to the Security Group associated with the EC2 instancesAnswer
  3. C
    Add an inbound deny rule for the malicious IP range to the Security Group associated with the EC2 instances
  4. D
    Add an outbound allow rule for SSH return traffic to the Security Group associated with the EC2 instances
  5. E
    Submit an AWS Support ticket requesting that the physical network infrastructure switches block the malicious IP range

Answer

Configure an inbound deny rule for the malicious IP range in the Network Access Control List (Network ACL) associated with the subnet, and configure an inbound allow rule for SSH from the bastion host in the Security Group associated with the EC2 instances.
The correct configurations involve using a Network ACL at the subnet boundary to explicitly deny the malicious IP range, and using a stateful Security Group at the instance level to allow inbound SSH from the bastion host. Since Network ACLs support deny rules and operate at the subnet level, they block the traffic before it reaches the instances. Since Security Groups are stateful, return traffic is automatically allowed, making outbound configurations for this stream unnecessary.

Step-by-Step Solution

1
Analyze the requirement to block a specific malicious IP range at the subnet boundary.
Network ACLs operate at the subnet level and support explicit deny rules. Therefore, an inbound deny rule must be added to the Network ACL associated with the private subnet.
Security groups operate at the instance level and only support allow rules, so they cannot be used to explicitly deny traffic from a specific IP range.
2
Analyze the requirement to allow SSH traffic to the EC2 instances from a bastion host with automatic return traffic.
Security groups operate at the instance level and are stateful. Adding an inbound allow rule for SSH from the bastion host's IP address will automatically permit the outbound return traffic.
Since security groups are stateful, no matching outbound rule is required to allow return traffic, unlike Network ACLs which are stateless.

Key Concept

Security Groups are stateful firewalls operating at the instance level (allowing only allow rules), whereas Network ACLs are stateless firewalls operating at the subnet level (supporting both allow and deny rules). Under the Shared Responsibility Model, configuration of these firewalls is the customer's responsibility.
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic