Examkin

Question

Difficulty: EasyNetwork and Infrastructure Security

An AWS cloud practitioner is configuring network security within a Virtual Private Cloud (VPC). To ensure proper network isolation, they need to identify the operational differences between Security Groups and Network Access Control Lists (Network ACLs). Which of the following statements correctly describe the behavior of these security controls? (Select TWO.)

  1. Security groups are stateful, meaning that return traffic is automatically allowed regardless of outbound rules.Answer
  2. Network Access Control Lists (Network ACLs) are stateless, meaning that return traffic must be explicitly allowed by rules in both directions.Answer
  3. C
    Security groups operate at the subnet boundary and apply to all resources contained within that subnet.
  4. D
    Network Access Control Lists (Network ACLs) operate at the EC2 instance level, acting as a dedicated host firewall.
  5. E
    Under the AWS Shared Responsibility Model, the customer is responsible for managing the physical security of the network infrastructure.

Answer

Security groups are stateful, meaning return traffic is automatically allowed; and Network Access Control Lists (Network ACLs) are stateless, meaning return traffic must be explicitly allowed in both directions.
The correct options are the statements indicating that Security Groups are stateful and Network Access Control Lists (Network ACLs) are stateless. In AWS, Security Groups automatically allow return traffic for any established connection, while Network ACLs require explicit inbound and outbound rules to permit traffic in both directions.

Step-by-Step Solution

1
Analyze the stateful behavior of Security Groups.
Confirm that Security Groups automatically track connection state and allow return traffic without needing explicit outbound rules.
This is a fundamental concept of Security Groups operating as an instance-level firewall.
2
Analyze the stateless behavior of Network ACLs.
Confirm that Network ACLs do not track connection state, meaning inbound and outbound rules must be configured separately to allow round-trip communication.
This is a fundamental concept of Network ACLs operating as a subnet-level firewall.
3
Evaluate the remaining options for layer of operation and responsibility mappings.
Identify that Security Groups operate at the instance level (not subnet level), Network ACLs operate at the subnet level (not instance level), and physical security is the responsibility of AWS (not the customer).
This helps rule out incorrect options based on common AWS CCP security misconceptions.

Key Concept

The operational differences between stateful Security Groups at the instance level and stateless Network ACLs at the subnet level.
Estimated Time:45s
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic