Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

An online education platform hosts its virtual classroom application on Amazon EC2 instances within a public subnet of a VPC. To enhance security, the network administrator must meet two requirements:
1. Block all inbound traffic from a known list of malicious IP addresses before it reaches the subnet.
2. Ensure the EC2 instances accept inbound HTTPS traffic on port 443, while automatically allowing the outbound response traffic back to the clients without configuring any outbound rules.
Which combination of AWS security features will satisfy these requirements?

  1. A
    A Security Group at the instance level to deny the malicious IP addresses, and a Network Access Control List (NACL) at the subnet level to allow inbound port 443 traffic
  2. B
    A Security Group at the subnet level to deny the malicious IP addresses, and a Network Access Control List (NACL) at the instance level to allow inbound port 443 traffic
  3. A Network Access Control List (NACL) at the subnet level to deny the malicious IP addresses, and a Security Group at the instance level to allow inbound port 443 trafficAnswer
  4. D
    A Network Access Control List (NACL) at the subnet level to deny the malicious IP addresses, and Amazon Inspector at the instance level to automatically allow the return traffic

Answer

A Network Access Control List (NACL) at the subnet level to deny the malicious IP addresses, and a Security Group at the instance level to allow inbound port 443 traffic
The correct option is the one specifying a Network Access Control List (NACL) at the subnet level to deny the malicious IP addresses, and a Security Group at the instance level to allow inbound port 443 traffic. A NACL operates at the subnet level and supports explicit deny rules, which satisfies the first requirement of blocking specific IP addresses. A Security Group operates at the instance level and is stateful, which automatically allows return traffic for any established inbound connection, meeting the second requirement without needing outbound rules.

Step-by-Step Solution

1
Analyze the requirement to block malicious IP addresses before traffic reaches the subnet.
Identify that a Network Access Control List (NACL) is applied at the subnet boundary and supports explicit 'deny' rules to block specific IP addresses.
Security Groups only support 'allow' rules and cannot block specific IP addresses directly; therefore, a NACL is needed at the subnet boundary.
2
Analyze the requirement to allow inbound HTTPS traffic (port 443) and automatically permit outbound response traffic without outbound rules.
Identify that Security Groups are stateful firewalls that operate at the instance level, allowing return traffic automatically without needing corresponding outbound rules.
NACLs are stateless and require explicit outbound rules for return traffic, which violates the requirement of not needing outbound rules.

Key Concept

Stateful vs. Stateless network filtering in AWS VPC (Security Groups vs. Network ACLs)
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic