Examkin

Question

Difficulty: HardNetwork and Infrastructure Security

A company is hosting a secure web application on Amazon EC2 instances within a VPC. The security team wants to allow incoming traffic on port 443443 (HTTPS) while blocking a specific range of known malicious IP addresses at the boundary before the traffic reaches any EC2 instance. They also need to ensure that the EC2 instances can send outbound response traffic back to clients. Which of the following network security configurations meets these requirements?

  1. A
    Configure a stateless Security Group at the instance level to deny the malicious IP range, and apply a stateful Network ACL at the subnet level to allow inbound HTTPS traffic, which will automatically permit the outbound response traffic.
  2. B
    Submit an AWS Support request to apply a global IP block at the AWS perimeter, as infrastructure edge protection and customer subnet routing configurations are the sole responsibility of AWS under the Shared Responsibility Model.
  3. Apply a stateful Security Group to the EC2 instances to allow inbound HTTPS traffic, and configure a stateless Network ACL at the subnet level with a rule that denies the malicious IP range and a rule that allows inbound HTTPS traffic along with outbound ephemeral port traffic.Answer
  4. D
    Deploy Amazon Inspector at the subnet boundary to analyze network packets and dynamically modify the instance firewalls to block the malicious IP range.

Answer

Apply a stateful Security Group to the EC2 instances to allow inbound HTTPS traffic, and configure a stateless Network ACL at the subnet level with a rule that denies the malicious IP range and a rule that allows inbound HTTPS traffic along with outbound ephemeral port traffic.
The correct configuration combines stateful Security Groups at the instance level with stateless Network ACLs at the subnet level. Because Security Groups are stateful, allowing inbound HTTPS traffic on port 443443 automatically permits the return outbound traffic. Because Network ACLs are stateless, they require both inbound and outbound rules to allow the connection to succeed, which includes allowing outbound ephemeral port traffic (1024−655351024-65535). Additionally, Network ACLs support explicit deny rules, which makes them the correct choice for blocking a specific malicious IP range at the subnet boundary.

Step-by-Step Solution

1
Analyze the requirement to block a specific malicious IP range at the subnet boundary.
Network Access Control Lists (NACLs) operate at the subnet boundary and support explicit deny rules, whereas Security Groups operate at the instance level and only support allow rules.
This establishes that the IP block must be implemented at the Network ACL level.
2
Evaluate the stateful behavior of Security Groups.
Security Groups are stateful. Allowing inbound traffic on port 443443 automatically allows the outbound response traffic.
This simplifies instance-level configurations since return traffic does not require an explicit outbound rule.
3
Evaluate the stateless behavior of Network ACLs.
Network ACLs are stateless. Inbound traffic allowed on port 443443 requires a corresponding outbound rule to allow ephemeral port traffic (1024−655351024-65535) back to the client.
Stateless firewalls do not track connection states, so both ingress and egress paths must be explicitly configured.
4
Verify shared responsibility boundaries.
Configuring firewalls (Security Groups and Network ACLs) in a customer's VPC is the customer's responsibility under the Shared Responsibility Model.
AWS manages physical and infrastructure security, while the customer secures their resources in the cloud.

Key Concept

Stateful Security Groups vs Stateless Network ACLs
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic