Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

A gaming company is deploying multiplayer session backends on Amazon Elastic Compute Cloud (Amazon EC2) instances. The system requires temporary outbound ports to be opened dynamically to send traffic back to clients. The security team wants to ensure that any outbound response traffic for established inbound connections is allowed automatically without needing to define explicit outbound rules. Additionally, these rules must apply directly at the instance level. Which AWS network security feature should the company use to meet these requirements?

  1. A
    Network Access Control Lists (Network ACLs)
  2. B
    AWS Shield
  3. Security GroupsAnswer
  4. D
    Amazon Inspector

Answer

Security Groups
Security groups act as stateful firewalls for EC2 instances, operating at the virtual interface level. Because they are stateful, any allowed inbound traffic automatically permits the corresponding outbound response traffic, regardless of any outbound security group rules.

Step-by-Step Solution

1
Analyze the requirement for instance-level traffic filtering.
Identify that firewalls at the instance level in AWS are Security Groups, whereas Network ACLs operate at the subnet level.
This narrows the choice down to instance-level firewalls.
2
Evaluate the requirement for automatically allowing return traffic without explicit outbound rules.
Understand that stateful firewalls automatically track connection state and allow return traffic, which is a key feature of Security Groups.
This distinguishes the stateful nature of Security Groups from the stateless nature of Network ACLs, which require explicit rules for return traffic.

Key Concept

Stateful instance-level security versus stateless subnet-level security in VPCs
Estimated Time:1m 15s
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic