An administrator wants to secure a web application hosted on Amazon EC2 instances. They need to implement a stateful firewall that controls traffic at the individual instance level, and a stateless firewall that controls traffic at the subnet boundary. Which two AWS features should the administrator configure to meet these requirements?
- Security groupsAnswer
- Network Access Control Lists (NACLs)Answer
- CVPC Peering connections
- DVPC route tables
- EAWS Identity and Access Management (IAM) roles
Answer
Security groups and Network Access Control Lists (NACLs)
Security groups act as a stateful firewall controlling traffic at the instance level, while Network Access Control Lists (NACLs) function as a stateless firewall operating at the boundary of the subnet. Together, they provide layered security for resources inside a VPC.
Step-by-Step Solution
Key Concept
AWS network security layers separating instance-level (Security Groups) and subnet-level (Network ACLs) controls.