Examkin

Question

Difficulty: MediumAWS Network Services

A cloud administrator is configuring network security for Amazon EC2 instances. The administrator needs to ensure that when inbound web traffic is allowed on port 443, the corresponding outbound response traffic is automatically permitted to return to the client without requiring an explicit outbound rule. Which AWS security feature should the administrator use to achieve this stateful behavior?

  1. A
    A Network Access Control List (NACL)
  2. A Security GroupAnswer
  3. C
    An AWS Transit Gateway
  4. D
    A VPC Peering connection

Answer

A Security Group
A Security Group is a stateful firewall that controls inbound and outbound traffic for Amazon EC2 instances. Because it is stateful, if an inbound rule allows traffic (such as on port 443), the corresponding outbound response traffic is automatically permitted to return, regardless of any outbound rules.

Step-by-Step Solution

1
Identify the requirement for stateful behavior where inbound allowed traffic automatically permits returning outbound response traffic.
The security resource must track the state of connections at the instance level.
Stateful firewalls automatically allow response traffic, whereas stateless firewalls require rules in both directions.
2
Evaluate the available options to determine which one is a stateful security feature at the instance level.
Security Groups are stateful and operate at the instance level, whereas Network ACLs are stateless and operate at the subnet level.
This matches the requirement to allow return traffic automatically without explicit outbound rules.

Key Concept

Stateful vs Stateless Network Filtering in AWS
Rate this question

Topics

AWS Network Services

More questions from this topic