A financial services firm is deploying a trade processing application on Amazon EC2 instances within a private subnet. The system architecture requires separating instance-level traffic control from subnet-level boundaries. Which of the following statements accurately describe how the administrator should configure Security Groups and Network Access Control Lists (Network ACLs) for this environment? (Select TWO.)
- Security groups are stateful, meaning return traffic is automatically allowed, and they are applied at the instance level.Answer
- Network ACLs are stateless, meaning separate inbound and outbound rules are required to allow traffic, and they are applied at the subnet level.Answer
- CNetwork ACLs are stateful, meaning they automatically track connection state and allow return traffic at the subnet level.
- DAWS is responsible for managing security group rules and Network ACL rules on behalf of the customer under the Shared Responsibility Model.
- EAmazon Inspector should be configured to analyze VPC Flow Logs for intelligent threat detection and block malicious traffic at the subnet level.
Answer
The correct options are: 'Security groups are stateful, meaning return traffic is automatically allowed, and they are applied at the instance level' and 'Network ACLs are stateless, meaning separate inbound and outbound rules are required to allow traffic, and they are applied at the subnet level'.
The correct options accurately describe the basic properties and boundaries of AWS network security firewalls. Security groups are stateful firewalls operating at the instance level (automatically allowing return traffic). Network ACLs are stateless firewalls operating at the subnet level (requiring separate inbound and outbound configuration).
Step-by-Step Solution
Key Concept
AWS Network security involves layering Security Groups (instance-level, stateful) and Network ACLs (subnet-level, stateless) to achieve defense in depth.