Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

An eco-tourism agency hosts its public-facing room booking portal on Amazon EC2 instances within a public subnet, and its internal database on EC2 instances within a private subnet. The security team needs to configure network security controls to meet two requirements: block specific malicious public IP addresses at the subnet boundary, and allow the web servers to communicate with the database while ensuring return traffic is automatically allowed at the instance level. Which TWO configurations should the security team implement to meet these requirements?

  1. Create an inbound deny rule in the Network ACL associated with the web server subnet to block the malicious IP addresses.Answer
  2. Configure the database security group to allow inbound traffic from the web servers, relying on the stateful nature of security groups to permit return traffic.Answer
  3. C
    Create an inbound deny rule in the security group associated with the web servers to block the malicious IP addresses.
  4. D
    Configure the web server subnet Network ACL to allow outbound traffic to the database subnet, as Network ACLs are stateful and will automatically track and permit return traffic.
  5. E
    Deploy Amazon Inspector to scan incoming network traffic at the subnet boundary and automatically block the malicious IP addresses.

Answer

The security team should create an inbound deny rule in the Network ACL associated with the web server subnet, and configure the database security group to allow inbound traffic from the web servers.
The requirements are met by combining a Network ACL and a Security Group. A Network ACL operates at the subnet boundary and supports explicit deny rules, which allows the security team to block specific malicious IP addresses. A security group operates at the instance level and is stateful, meaning that allowing inbound traffic automatically permits the corresponding outbound return traffic without requiring separate outbound configuration.

Step-by-Step Solution

1
Identify the service required to block specific IP addresses at the subnet level.
Network Access Control Lists (NACLs) operate at the subnet boundary and support explicit deny rules, allowing the blocking of specific malicious IP addresses.
Security groups do not support deny rules and operate at the instance level, not the subnet boundary.
2
Identify the configuration required to allow instance-to-instance communication with automatic return traffic.
Security groups are stateful firewalls at the instance level; allowing inbound traffic automatically permits the corresponding return traffic.
Using a stateful security group eliminates the need to configure outbound rules for return traffic, whereas a stateless Network ACL would require explicit configuration in both directions.

Key Concept

Security groups are stateful firewalls at the instance level that support only allow rules, whereas Network ACLs are stateless firewalls at the subnet level that support both allow and deny rules.
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic