Examkin

Question

Difficulty: MediumAWS Network Services

A company is hosting a database instance in a private subnet of a Virtual Private Cloud (VPC). The database should only accept incoming traffic from web application servers running in a public subnet of the same VPC. To implement this restriction, the company wants to deploy a stateful firewall that controls inbound and outbound traffic at the individual instance level. Which AWS network security feature should be used to meet these requirements?

  1. A
    Network Access Control Lists (Network ACLs)
  2. B
    VPC Peering
  3. Security groupsAnswer
  4. D
    AWS Transit Gateway

Answer

Security groups
Security groups act as a stateful firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. They allow you to specify permit rules, and because they are stateful, any allowed inbound traffic is automatically allowed outbound, satisfying the requirement to secure individual database instances.

Step-by-Step Solution

1
Identify the level at which the firewall must operate based on the requirements.
The requirement specifies controlling traffic at the individual instance level, not the subnet level.
This distinguishes between security groups (which operate at the instance level) and Network ACLs (which operate at the subnet level).
2
Evaluate the statefulness requirement.
The scenario requires a stateful firewall.
Security groups are stateful, meaning allowed inbound traffic automatically permits return outbound traffic. Network ACLs are stateless and require explicit rules in both directions.

Key Concept

Security groups act as stateful firewalls at the instance level, whereas Network ACLs act as stateless firewalls at the subnet level.
Estimated Time:1m 0s
Rate this question

Topics

AWS Network Services

More questions from this topic