Examkin

Question

Difficulty: MediumAWS Network Services

An organization needs to secure a web application deployed on Amazon EC2 instances. The security administrator must implement a rule to block traffic from a specific malicious IP address before it enters the subnet. Additionally, the administrator wants to allow incoming HTTP traffic to the EC2 instances such that return traffic is automatically allowed without requiring an outbound rule.

Which of the following Amazon VPC security features should the administrator configure to meet these requirements? (Select TWO.)

  1. Security GroupsAnswer
  2. Network Access Control Lists (Network ACLs)Answer
  3. C
    AWS WAF (Web Application Firewall)
  4. D
    AWS Transit Gateway
  5. E
    VPC Peering

Answer

Security Groups and Network Access Control Lists (Network ACLs)
The correct options are Security Groups and Network Access Control Lists (Network ACLs). Network ACLs act as a stateless firewall at the subnet level and allow the configuration of explicit deny rules to block a specific malicious IP address before traffic reaches the EC2 instances. Security Groups act as a stateful firewall at the instance level, meaning that once inbound HTTP traffic is permitted, the return outbound traffic is automatically allowed without requiring a matching outbound rule.

Step-by-Step Solution

1
Identify the service needed to block traffic from a specific malicious IP address before it enters the subnet.
Network Access Control Lists (Network ACLs) operate at the subnet level and support explicit deny rules, which allows blocking specific IP addresses.
Security groups do not support deny rules and operate at the instance level rather than the subnet level.
2
Identify the service needed to allow incoming HTTP traffic to EC2 instances such that return traffic is automatically allowed.
Security Groups are stateful firewalls operating at the instance level. Because they are stateful, allowing inbound traffic automatically allows the return outbound traffic.
Network ACLs are stateless, meaning outbound return traffic must be explicitly allowed by outbound rules.

Key Concept

Understanding the differences between Security Groups (stateful, instance-level, allow-only rules) and Network ACLs (stateless, subnet-level, allow and deny rules) for securing an Amazon VPC environment.
Rate this question

Topics

AWS Network Services

More questions from this topic