Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

A municipality is deploying a smart parking system that collects sensor data using Amazon EC2 instances located in a private subnet. The network engineering team must design a security controls strategy to govern inbound and outbound traffic at both the subnet boundary and the instance level. Which two of the following statements correctly describe the behavior of the security components needed for this architecture?

  1. Security groups operate at the instance level and are stateful, meaning that return traffic is automatically allowed regardless of outbound rules.Answer
  2. Network Access Control Lists (Network ACLs) operate at the subnet level and are stateless, meaning that outbound rules must explicitly allow return traffic for allowed inbound requests.Answer
  3. C
    Security groups operate at the subnet level and are stateless, requiring explicit outbound rules to permit return traffic for any incoming connection.
  4. D
    Network Access Control Lists (Network ACLs) operate at the instance level and are stateful, meaning they automatically permit return traffic without evaluating outbound rules.
  5. E
    Amazon GuardDuty can be deployed directly inside the private subnet to act as a stateless firewall, blocking malicious IP addresses at the instance network interface.

Answer

Security groups operate at the instance level and are stateful, meaning that return traffic is automatically allowed regardless of outbound rules; and Network Access Control Lists (Network ACLs) operate at the subnet level and are stateless, meaning that outbound rules must explicitly allow return traffic for allowed inbound requests.
The correct answers identify that Security Groups operate at the instance level and are stateful, and Network ACLs operate at the subnet level and are stateless. In a stateful security group, return traffic is automatically allowed. In a stateless Network ACL, outbound rules must be explicitly configured to allow the return traffic.

Step-by-Step Solution

1
Evaluate the traffic management requirements at the instance level.
Determine that security groups are evaluated at the instance level and are stateful, meaning that return traffic is automatically permitted.
Security groups act as a firewall at the network interface level for EC2 instances, and their stateful nature ensures established connections do not need symmetric rules.
2
Evaluate the traffic management requirements at the subnet boundary level.
Determine that Network ACLs are evaluated at the subnet level and are stateless, meaning that inbound and outbound rules are processed independently.
Network ACLs act as a boundary firewall for the entire subnet, and because they are stateless, return traffic must be explicitly allowed by a corresponding outbound rule.

Key Concept

The stateful behavior of Security Groups at the instance level versus the stateless behavior of Network ACLs at the subnet level.
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic