A gaming company is deploying matchmaking servers on Amazon EC2 instances within a Virtual Private Cloud (VPC). The network security architecture must meet the following requirements:
1. Control traffic at the individual instance level, ensuring that return traffic for allowed inbound requests is automatically permitted.
2. Control traffic at the subnet boundary, acting as a secondary layer of defense that requires explicit rules for both inbound and outbound traffic.
Which two AWS network security features should the company implement to meet these requirements? (Select TWO.)
- Security GroupsAnswer
- Network Access Control Lists (NACLs)Answer
- CAWS WAF
- DAmazon GuardDuty
- EAWS Shield
Answer
Security Groups and Network Access Control Lists (NACLs)
The correct choices are Security Groups and Network Access Control Lists (NACLs). Security Groups act as a firewall for EC2 instances and are stateful, meaning any allowed inbound traffic automatically permits the corresponding outbound return traffic. Network Access Control Lists (NACLs) act as a firewall at the subnet boundary and are stateless, meaning return traffic must be explicitly allowed by configuring both inbound and outbound rules.
Step-by-Step Solution
Key Concept
Understanding the differences between Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level) in AWS VPC security.
Estimated Time:1m 30s