Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

A financial services firm is deploying a web application on Amazon EC2 instances in a new Virtual Private Cloud (VPC). The network security team wants to configure a firewall control that operates at the instance level. They require that any inbound traffic allowed into the instance is automatically permitted to flow outbound, without needing to create a corresponding outbound rule. Which AWS resource meets these requirements?

  1. A
    A network access control list (NACL), because it is stateful and evaluates traffic at the subnet level.
  2. B
    AWS physical firewalls, because AWS is responsible for configuring all instance-level traffic rules under the Shared Responsibility Model.
  3. A security group, because it is stateful and evaluates traffic at the instance level.Answer
  4. D
    A security group, because it is stateless and evaluates traffic at the subnet level.

Answer

A security group, because it is stateful and evaluates traffic at the instance level.
The correct answer states that a security group is stateful and operates at the instance level. In AWS, security groups act as virtual firewalls for EC2 instances. Because they are stateful, connection tracking automatically permits response traffic to flow back to the client even if no outbound rules allow it.

Step-by-Step Solution

1
Determine the required evaluation boundary (subnet vs. instance).
The requirement specifies instance-level control, which aligns with Security Groups rather than Network ACLs (which operate at the subnet level).
Identifying the correct layer of defense helps narrow down the appropriate AWS security service.
2
Identify the statefulness requirements for return traffic.
The requirement demands that return traffic is automatically allowed without explicit rules. This is the definition of stateful connection tracking, which is supported by Security Groups.
Stateless controls like Network ACLs evaluate inbound and outbound traffic independently, requiring manual rules for both directions.

Key Concept

AWS Security Groups are stateful firewalls that operate at the instance level, whereas Network ACLs are stateless firewalls that operate at the subnet level.
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic