Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

An inventory management system hosts its database on Amazon EC2 instances within a private subnet. The database instances must only receive inbound database traffic on port 5432 from the application tier EC2 instances. A cloud practitioner configures a Security Group for the database instances with an inbound rule allowing TCP traffic on port 5432 from the application tier's security group. Which of the following outbound configuration options is required on the database security group to allow the database instances to successfully return response traffic back to the application tier?

  1. No outbound rule is required because Security Groups are stateful, meaning allowed inbound traffic automatically permits the corresponding response traffic.Answer
  2. B
    An outbound rule must be added to allow return traffic because Security Groups are stateless and do not automatically allow response traffic.
  3. C
    An outbound rule is not required because the subnet-level Network Access Control List (NACL) automatically handles stateful return traffic for the EC2 instance.
  4. D
    AWS automatically manages all inbound and outbound traffic rules at the hypervisor level as part of the AWS shared responsibility model, making manual rules unnecessary.

Answer

No outbound rule is required because Security Groups are stateful, meaning allowed inbound traffic automatically permits the corresponding response traffic.
The correct option is correct because Security Groups in AWS are stateful firewall devices. When an inbound rule permits traffic to enter an instance (such as database traffic on port 5432), the security group automatically allows the return response traffic to leave the instance, regardless of the outbound rules configured.

Step-by-Step Solution

1
Identify the resource-level security component being configured.
The resource is an Amazon EC2 instance using a Security Group.
Security Groups act as a firewall at the instance level, controlling both inbound and outbound traffic.
2
Determine the stateful nature of the security component.
Security Groups are stateful, which means they automatically allow return traffic for any established connection.
Since the inbound rule already permits the application tier to connect on port 5432, the response traffic is implicitly allowed out without a separate outbound rule.

Key Concept

Stateful behavior of Security Groups versus stateless behavior of Network ACLs
Estimated Time:1m 0s
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic