Examkin

Question

Difficulty: HardNetwork and Infrastructure Security

An organization hosts a web application on Amazon EC2 instances in a public subnet. The security team wants to allow web clients to access the instances over HTTP (port 80) and HTTPS (port 443). However, to prevent data exfiltration, the EC2 instances must be restricted from initiating any outbound connections to the internet, while still allowing them to return responses to client requests. Which of the following configurations are required to achieve this goal? (Select TWO.)

  1. Configure the Security Group associated with the EC2 instances to allow inbound traffic on TCP ports 80 and 443 from any source, and remove the default outbound rule that allows all traffic.Answer
  2. Configure the Network Access Control List (Network ACL) of the public subnet to allow inbound traffic on TCP ports 80 and 443 from any source, and add an outbound rule allowing TCP traffic to ephemeral ports 1024-65535.Answer
  3. C
    Configure the Security Group associated with the EC2 instances to allow inbound traffic on TCP ports 80 and 443, and add an outbound Security Group rule allowing return traffic to ephemeral ports 1024-65535.
  4. D
    Configure the Network Access Control List (Network ACL) of the public subnet to allow inbound traffic on TCP ports 80 and 443 from any source, and remove all outbound rules from the Network ACL.
  5. E
    Configure the Web Application Firewall (AWS WAF) associated with the public subnet to block all outgoing traffic initiating from the EC2 instances while allowing return traffic.

Answer

Configure the Security Group associated with the EC2 instances to allow inbound traffic on TCP ports 80 and 443 from any source, and remove the default outbound rule that allows all traffic. Additionally, configure the Network Access Control List (Network ACL) of the public subnet to allow inbound traffic on TCP ports 80 and 443 from any source, and add an outbound rule allowing TCP traffic to ephemeral ports 1024-65535.
The correct combination involves understanding the stateful nature of Security Groups and the stateless nature of Network ACLs. The Security Group configuration allows inbound HTTP/HTTPS traffic, which automatically permits outbound responses due to state tracking, while removing outbound rules prevents the instances from initiating outbound connections. The Network ACL configuration requires inbound rules for ports 80/443 and outbound rules for the ephemeral ports (1024-65535) to allow return packets, because Network ACLs do not track connection states.

Step-by-Step Solution

1
Analyze the stateful nature of Security Groups.
Since Security Groups operate at the instance level and are stateful, any inbound traffic allowed is automatically permitted to return outbound. Therefore, to allow incoming web traffic while blocking instances from initiating outbound traffic, we must allow inbound ports 80 and 443, and remove the outbound rule that allows all traffic.
This meets the requirement of allowing inbound HTTP/HTTPS requests and return traffic, while preventing the instances from initiating outbound requests.
2
Analyze the stateless nature of Network ACLs.
Network ACLs operate at the subnet boundary and are stateless. This means we must explicitly define rules for both inbound and outbound directions. To allow inbound client traffic, we permit ports 80 and 443. To allow the return traffic back to those clients, we must add an outbound rule permitting traffic to ephemeral ports (1024-65535).
Since Network ACLs do not track connection states, omitting the outbound ephemeral port rule would block the return traffic.

Key Concept

Stateful vs. Stateless network filtering in AWS (Security Groups vs. Network ACLs)
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic