Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

A financial services firm hosts a reporting database on Amazon EC2 instances in a private subnet. A cloud practitioner needs to configure network security controls to protect the database. They must implement both a security group and a network access control list (network ACL). Which of the following statements correctly describe the behavior of these security controls? (Select TWO.)

  1. The security group automatically allows outbound response traffic if the inbound request is allowed on port 33063306, because security groups are stateful.Answer
  2. The network ACL requires an outbound rule to allow response traffic even if the inbound request on port 33063306 is allowed, because network ACLs are stateless.Answer
  3. C
    The security group operates at the subnet boundary to protect all resources, whereas the network ACL operates at the individual instance network interface layer.
  4. D
    The network ACL automatically allows outbound response traffic once the inbound traffic is allowed on port 33063306, because network ACLs are stateful by default.
  5. E
    The configuration of security group and network ACL rules is the sole responsibility of AWS under the infrastructure security portion of the AWS Shared Responsibility Model.

Answer

The correct answers are the statements describing that security groups automatically allow return traffic because they are stateful, and that network ACLs require an outbound rule to allow return traffic because they are stateless.
Security groups are stateful, which means they automatically allow return traffic for any established connection. Network ACLs are stateless, meaning they evaluate traffic going in and out of the subnet independently. Therefore, to support a database connection, a network ACL requires explicit rules for both inbound database request traffic and outbound return traffic, whereas a security group only requires an inbound rule.

Step-by-Step Solution

1
Analyze the stateful behavior of Security Groups.
Since security groups are stateful, allowing inbound traffic on port 33063306 automatically allows return outbound traffic.
Stateful firewalls track the connection state and allow response traffic automatically.
2
Analyze the stateless behavior of Network ACLs.
Since network ACLs are stateless, allowing inbound traffic on port 33063306 does not automatically allow return outbound traffic. An outbound rule must be explicitly created.
Stateless firewalls evaluate rules for inbound and outbound traffic independently without tracking connection states.
3
Verify subnet vs. instance level placement and responsibilities.
Security groups apply at the instance/network interface level, while network ACLs apply at the subnet level. Both are customer-configured security controls.
This confirms that the other options mischaracterize their operating boundaries or misapply the Shared Responsibility Model.

Key Concept

Stateful vs. Stateless Network Security Controls (Security Groups and Network ACLs)
Estimated Time:1m 30s
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic