Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

A research institution runs high-performance scientific simulations on Amazon EC2 instances within a private subnet. The security team must implement a network security strategy that meets two requirements:

1. Block traffic from a specific range of external IP addresses at the subnet boundary by explicitly evaluating both inbound and outbound traffic.
2. Allow incoming simulation control data to the EC2 instances, ensuring that return traffic is automatically permitted without requiring explicit outbound rules.

Which combination of AWS features best satisfies these requirements?

  1. A
    Security Groups at the subnet level to block the IP range, and Network Access Control Lists (NACLs) at the instance level to allow the control data
  2. B
    Amazon Inspector at the subnet level to block the IP range, and Amazon GuardDuty at the instance level to allow the control data
  3. Network Access Control Lists (NACLs) at the subnet level to block the IP range, and Security Groups at the instance level to allow the control dataAnswer
  4. D
    AWS infrastructure security to automatically block the IP range at the subnet level under the Shared Responsibility Model, and Security Groups at the instance level to allow the control data

Answer

Network Access Control Lists (NACLs) at the subnet level to block the IP range, and Security Groups at the instance level to allow the control data
The correct answer correctly identifies that Network Access Control Lists (NACLs) operate at the subnet level and are stateless, meaning both inbound and outbound traffic must be explicitly allowed or denied. This makes NACLs ideal for blocking specific IP ranges at the subnet boundary. Security Groups operate at the instance level and are stateful, meaning any allowed inbound traffic automatically permits the corresponding outbound response traffic, satisfying the second requirement.

Step-by-Step Solution

1
Evaluate the first requirement: blocking a specific IP range at the subnet boundary with explicit inbound and outbound evaluation.
This requires a subnet-level firewall that is stateless, meaning outbound traffic must be explicitly evaluated alongside inbound traffic. Network Access Control Lists (NACLs) operate at the subnet level and are stateless.
Stateless firewalls do not track connection states, so both directions of traffic must have explicit rules.
2
Evaluate the second requirement: allowing simulation traffic at the instance level with automatic return traffic permission.
This requires an instance-level firewall that is stateful, meaning response traffic is automatically allowed if the request is permitted. Security Groups operate at the instance level and are stateful.
Stateful firewalls track the state of connections and automatically permit response traffic without needing explicit outbound rules.
3
Combine both components to select the option that uses NACLs at the subnet level and Security Groups at the instance level.
The correct combination uses NACLs for the subnet-level blocklist and Security Groups for instance-level simulation data filtering.
This architecture correctly utilizes the distinct properties of stateful and stateless firewalls at their respective boundaries.

Key Concept

Stateful vs. Stateless network firewalls in a VPC (Security Groups vs. Network ACLs)
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic