Examkin

Question

Difficulty: EasyNetwork and Infrastructure Security

A developer is troubleshooting connectivity to an Amazon EC2 instance and needs to analyze the firewall settings. The developer must evaluate the differences in behavior between security groups and network access control lists (network ACLs). Which two statements correctly describe how traffic is processed by these security features? (Select TWO.)

  1. Security groups are stateful firewalls that automatically allow return traffic for allowed inbound requests.Answer
  2. Network Access Control Lists (network ACLs) are stateless firewalls that require explicit rules for both inbound and outbound traffic.Answer
  3. C
    Security groups operate at the subnet level to secure all EC2 instances within that subnet.
  4. D
    Network Access Control Lists (network ACLs) operate at the instance level to secure individual EC2 instances.
  5. E
    AWS automatically configures and manages all security group rules for customer-deployed EC2 instances.

Answer

Security groups are stateful firewalls that automatically allow return traffic, and Network Access Control Lists (network ACLs) are stateless firewalls that require explicit rules for both inbound and outbound traffic.
Security groups are stateful, meaning they track connection states and automatically allow return traffic for any established connection. Network ACLs are stateless, meaning they evaluate traffic in both directions independently and require explicit rules for both inbound and outbound traffic flow.

Step-by-Step Solution

1
Analyze how statefulness affects traffic evaluation in Security Groups and Network ACLs.
Security groups automatically allow return traffic (stateful), while Network ACLs evaluate return traffic against rules (stateless).
This determines whether a separate rule is needed for return communication.
2
Identify the boundary levels where each firewall applies.
Security groups operate at the instance level (network interface), while Network ACLs operate at the subnet level.
This establishes where the traffic filtering takes place.
3
Determine customer security responsibilities under the Shared Responsibility Model.
The customer must define and manage all security rules inside their VPC.
AWS does not manage customer firewall rules; this is a customer responsibility.

Key Concept

Stateful vs. Stateless VPC Firewalls
Estimated Time:1m 0s
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic