Examkin

Question

Difficulty: HardNetwork and Infrastructure Security

A startup is designing a secure multi-tier environment in an Amazon VPC. They require a network security control at the subnet boundary that does not track connection state, meaning inbound and outbound traffic must be allowed via explicit, separate rules. For individual Amazon EC2 instances, they require a firewall that automatically allows outbound return traffic if the inbound request is permitted. Which combination of AWS network security features should the startup implement to meet these requirements?

  1. Network Access Control Lists (NACLs) at the subnet level, and Security Groups at the instance level.Answer
  2. B
    Security Groups at the subnet level, and Network Access Control Lists (NACLs) at the instance level.
  3. C
    Network Access Control Lists (NACLs) configured in stateful mode at both the subnet and instance levels.
  4. D
    AWS WAF at the subnet level, and Security Groups in stateless mode at the instance level.

Answer

Network Access Control Lists (NACLs) at the subnet level, and Security Groups at the instance level.
The correct option is correct because Network Access Control Lists (NACLs) are stateless and applied at the subnet boundary, fulfilling the requirement for separate inbound/outbound evaluation. Security Groups are stateful and applied at the instance level, fulfilling the requirement for automatic return traffic permission.

Step-by-Step Solution

1
Identify the service that operates at the subnet boundary and is stateless.
Network Access Control Lists (NACLs) are stateless firewalls that control traffic at the subnet boundary, requiring explicit rules for both inbound and outbound traffic.
NACLs do not track connection state, meaning return traffic must be explicitly permitted by a corresponding rule in the opposite direction.
2
Identify the service that operates at the instance level and is stateful.
Security Groups are stateful firewalls that secure individual instances (virtual interfaces), automatically allowing return traffic.
Security Groups track the state of connections, allowing response traffic to flow back to the requester automatically without requiring an explicit rule.
3
Select the option combining NACLs at the subnet level and Security Groups at the instance level.
The correct combination aligns NACLs at the subnet layer and Security Groups at the instance layer.
This configuration satisfies both the stateless subnet boundary requirement and the stateful instance firewall requirement.

Key Concept

Stateful vs. Stateless AWS Network Security Features
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic