When configuring security controls within an Amazon Virtual Private Cloud (VPC), understanding the behavior of instance-level and subnet-level firewalls is critical. Which two of the following statements correctly describe the operational characteristics of these network security resources?
- Instance-level firewalls (Security Groups) are stateful, meaning that return traffic is automatically allowed regardless of outbound rules.Answer
- Subnet-level firewalls (Network Access Control Lists) are stateless, meaning that return traffic must be explicitly allowed by an outbound rule.Answer
- CInstance-level firewalls (Security Groups) are stateless, requiring separate rules for inbound and outbound traffic.
- DSubnet-level firewalls (Network Access Control Lists) operate at the instance level and automatically allow all return traffic.
- EAmazon Inspector is used as a real-time firewall to block malicious traffic at the subnet boundary.
Answer
The correct statements are that Security Groups (instance-level firewalls) are stateful and Network ACLs (subnet-level firewalls) are stateless.
Instance-level firewalls (Security Groups) are stateful, which means they automatically track connection state and allow return traffic without needing an explicit outbound rule. In contrast, subnet-level firewalls (Network ACLs) are stateless, which means they do not track connection state and require explicit rules for both inbound and outbound traffic.
Step-by-Step Solution
Key Concept
Stateful vs. Stateless Firewalls in AWS VPC (Security Groups and Network ACLs)