A company is designing a secure network architecture in Amazon Virtual Private Cloud (Amazon VPC). The security team requires two distinct layers of control: first, a stateless firewall that controls inbound and outbound traffic at the subnet boundary, and second, a stateful firewall that controls inbound and outbound traffic at the individual Amazon EC2 instance level. Which of the following network security features should the cloud practitioner configure to meet these requirements? (Select TWO.)
- Network Access Control Lists (NACLs) configured at the subnet level to provide stateless traffic filteringAnswer
- Security groups configured at the instance level to provide stateful traffic filteringAnswer
- CNetwork Access Control Lists (NACLs) configured at the instance level to provide stateful traffic filtering
- DSecurity groups configured at the subnet level to provide stateless traffic filtering
- EVPC Peering connections to route and isolate traffic between the web and database subnets
Answer
Configure Network Access Control Lists (NACLs) at the subnet level to provide stateless traffic filtering, and configure Security groups at the instance level to provide stateful traffic filtering.
The correct options are Network Access Control Lists (NACLs) at the subnet level and security groups at the instance level. NACLs act as a stateless firewall controlling traffic in and out of subnets, whereas security groups act as stateful firewalls controlling traffic at the instance level.
Step-by-Step Solution
Key Concept
Amazon VPC offers two layers of security to control traffic: security groups (stateful, instance-level) and network ACLs (stateless, subnet-level).
Estimated Time:1m 30s