Examkin

Question

Difficulty: EasyNetwork and Infrastructure Security

A cloud administrator is designing the network security architecture for a multi-tier application. The administrator needs to implement a firewall barrier at the boundary of a subnet that evaluates traffic flow in both directions independently (stateless). Which AWS resource must be used to achieve this?

  1. Network Access Control Lists (Network ACLs)Answer
  2. B
    Security Groups
  3. C
    Amazon GuardDuty
  4. D
    AWS physical security systems

Answer

Network Access Control Lists (Network ACLs)
Network Access Control Lists (Network ACLs) are the correct answer because they serve as a stateless firewall at the subnet level, inspecting traffic entering and exiting the subnet and requiring explicit rules for both directions.

Step-by-Step Solution

1
Identify the required network boundary for the security barrier.
The requirement specifies a barrier at the boundary of a subnet rather than at the individual instance level.
This narrows the choices down to subnet-level security features like Network ACLs.
2
Identify the evaluation state behavior required by the scenario.
The firewall must be stateless (evaluating traffic flow in both directions independently).
Network ACLs are stateless, meaning that outbound return traffic must be explicitly allowed, whereas Security Groups are stateful and automatically allow return traffic.

Key Concept

Stateful vs. Stateless Network Firewalls at Subnet and Instance Levels
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic