Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

A company hosts a payroll processing portal on Amazon EC2 instances inside a virtual private cloud (VPC). The security administrator needs to permit inbound HTTPS traffic on port 443 from a specific corporate office IP address range. The administrator wants the return traffic from the EC2 instances back to the corporate office to be permitted automatically without needing to define any outbound rules. Which AWS resource or feature should the administrator configure to meet these requirements?

  1. Security groups associated with the EC2 instancesAnswer
  2. B
    Network Access Control Lists (Network ACLs) applied to the subnet
  3. C
    Amazon GuardDuty enabled for the AWS account
  4. D
    The AWS Shared Responsibility Model infrastructure layer

Answer

Security groups associated with the EC2 instances
The correct answer is the option focusing on security groups associated with the EC2 instances. Security groups are stateful firewalls that operate at the instance level. Because they are stateful, any permitted inbound traffic automatically allows the return response traffic to flow back, eliminating the need to write a corresponding outbound rule.

Step-by-Step Solution

1
Analyze the requirement for automatic return traffic permission without explicit outbound rules.
Determined that the firewall mechanism must be stateful.
Stateful firewalls automatically allow response traffic for any established inbound connection.
2
Evaluate the stateful and stateless properties of AWS network security features.
Identified that Security Groups are stateful and operate at the instance level, whereas Network ACLs are stateless and operate at the subnet level.
This determines which configuration meets the automatic return traffic requirement.
3
Select the appropriate resource based on responsibility and firewall characteristics.
Security groups associated with the EC2 instances is the correct resource, as configuration of instance firewalls falls under the customer's responsibility.
Security groups satisfy both the technical stateful requirement and the shared responsibility model rules.

Key Concept

Security groups are stateful firewalls that control inbound and outbound traffic for Amazon EC2 instances, automatically allowing return traffic for any permitted inbound connection.
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic