Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

A gaming studio deploys a multiplayer matchmaking backend on Amazon EC2 instances inside a public subnet. The studio wants to ensure that only traffic from a specific list of trusted IP addresses can access these instances, and they want to minimize administrative overhead by relying on a stateful resource. Which AWS resource should be configured directly at the instance level to allow inbound traffic from these IP addresses while automatically permitting the corresponding outbound response traffic?

  1. A security groupAnswer
  2. B
    A network access control list (network ACL)
  3. C
    Amazon GuardDuty
  4. D
    An AWS-managed firewall configured by AWS under the Shared Responsibility Model

Answer

A security group
A security group acts as a virtual firewall that controls inbound and outbound traffic for Amazon EC2 instances. It operates at the instance level and is stateful, meaning that any allowed inbound traffic is automatically permitted to flow outbound, satisfying the requirement to minimize administrative overhead by avoiding separate outbound configuration.

Step-by-Step Solution

1
Identify the level of protection required (instance vs. subnet).
The requirement specifies configuring protection 'directly at the instance level', which points to security groups rather than network ACLs.
Security groups act as a firewall for associated Amazon EC2 instances, whereas network ACLs operate at the subnet boundary.
2
Determine the stateful or stateless nature of the required resource.
The resource must automatically permit outbound response traffic when inbound traffic is allowed (stateful behavior).
Security groups are stateful, meaning any allowed inbound traffic is automatically allowed outbound. Network ACLs are stateless and require explicit rules in both directions.
3
Evaluate the customer responsibility vs. AWS responsibility.
Configuring security controls on EC2 instances is the customer's responsibility under the Shared Responsibility Model.
AWS manages security of the cloud (infrastructure), while the customer manages security in the cloud (operating systems and network access controls).

Key Concept

Instance-level stateful firewalls in AWS (Security Groups)
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic