Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

An organization is deploying a web application on Amazon EC2 instances. The security team must ensure that inbound HTTP traffic to port 80 is permitted, and that the corresponding outbound response traffic is automatically allowed back to the client without needing a corresponding outbound rule. Which AWS security feature should be configured to meet this requirement?

  1. Security GroupsAnswer
  2. B
    Network Access Control Lists (NACLs)
  3. C
    Amazon Inspector
  4. D
    AWS Shield

Answer

Security Groups are stateful firewalls that operate at the instance level. When you allow inbound traffic on port 80, the return traffic is automatically allowed regardless of outbound rules. Network Access Control Lists (NACLs) are stateless and would require an explicit outbound rule. Amazon Inspector is a vulnerability scanner, and AWS Shield is for DDoS protection.
Security Groups are stateful firewalls operating at the instance level. Any permitted inbound traffic automatically allows the outbound response traffic to flow back, bypassing outbound rules. This aligns perfectly with the requirement to allow inbound HTTP traffic on port 80 and have the response traffic automatically permitted.

Step-by-Step Solution

1
Analyze the requirement for automatic return traffic.
The requirement specifies that outbound response traffic must be automatically permitted without an explicit outbound rule, indicating a stateful firewall behavior.
Identifying the stateful nature narrows the choices down to Security Groups, since they are stateful at the EC2 instance level.
2
Compare Security Groups and Network ACLs.
Security Groups are stateful (allowing return traffic automatically), while Network ACLs are stateless (requiring explicit rules in both directions).
This confirms that Security Groups are the correct configuration option to meet the organization's requirements.

Key Concept

Stateful vs. stateless network security controls in AWS VPC (Security Groups vs. Network ACLs)
Estimated Time:1m 0s
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic