Examkin

Question

Difficulty: HardNetwork and Infrastructure Security

A university is migrating its legacy student registration database to AWS. The database runs on Amazon EC2 instances within a private subnet of a Virtual Private Cloud (VPC). The security team has established two strict requirements:

1. Automatically deny all network traffic originating from a specific list of blacklisted external IP ranges at the subnet boundary.
2. Allow inbound database connections to the database instances on port 1521, while relying on the firewall's stateful behavior to automatically permit the returning outbound database traffic without requiring any explicit outbound rules.

Which of the following security configurations should the university implement to meet these requirements? (Select TWO.)

  1. Configure a Network Access Control List (Network ACL) at the subnet level with a rule to deny traffic from the blacklisted external IP ranges.Answer
  2. Configure a Security Group at the instance level to allow inbound connections on port 1521.Answer
  3. C
    Configure a Security Group at the instance level with a rule to deny traffic from the blacklisted external IP ranges.
  4. D
    Configure a Network Access Control List (Network ACL) at the subnet level to allow inbound connections on port 1521, relying on stateful tracking for the return traffic.
  5. E
    Deploy Amazon GuardDuty at the VPC boundary to automatically inspect and drop traffic from the blacklisted IP ranges.

Answer

To meet the requirements, the university should configure a Network Access Control List at the subnet level with a rule to deny traffic from the blacklisted external IP ranges, and configure a Security Group at the instance level to allow inbound connections on port 1521.
The requirement to deny blacklisted IP ranges at the subnet boundary is met by configuring a Network Access Control List with a deny rule, as Network ACLs operate at the subnet level and support explicit deny rules. The requirement to allow database connections statefully is met by configuring a Security Group, which operates at the instance level and automatically permits return traffic once inbound traffic is allowed.

Step-by-Step Solution

1
Evaluate the requirement to block specific external IP ranges at the subnet boundary.
Network Access Control Lists operate at the subnet boundary and support explicit deny rules, which makes them suitable for blocking the blacklisted IP ranges before traffic enters the subnet. Security groups operate at the instance level and only support allow rules.
This establishes that a Network ACL must be used for the IP blacklisting requirement.
2
Evaluate the requirement to allow database traffic on port 1521 statefully without explicit outbound rules.
Security Groups are stateful firewalls that operate at the instance level. When you allow inbound traffic on a port, the return outbound traffic is automatically allowed. Network ACLs are stateless, so they do not automatically allow return traffic.
This establishes that a Security Group must be configured for the database instances' inbound rules.

Key Concept

Stateful vs. Stateless Network Firewalls in AWS
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic