A company is configuring a Virtual Private Cloud (VPC) to host a new application. The security administrator wants to implement a defense-in-depth strategy by combining instance-level firewall protection with subnet-level firewall protection. Which of the following statements correctly describe the characteristics of Security Groups and Network Access Control Lists (Network ACLs)? (Select TWO.)
- ASecurity Groups are stateless firewalls that operate at the subnet level.
- BNetwork ACLs are stateful firewalls that operate at the instance level.
- Security Groups are stateful firewalls that control traffic at the instance level.Answer
- Network ACLs are stateless firewalls that control traffic at the subnet level.Answer
- EAWS is responsible for configuring all Security Group and Network ACL rules on behalf of the customer.
Answer
The correct answers are the statements that state Security Groups are stateful firewalls operating at the instance level, and Network ACLs are stateless firewalls operating at the subnet level.
Security Groups act as a firewall for associated Amazon EC2 instances, controlling both inbound and outbound traffic at the instance level. They are stateful, meaning any allowed inbound traffic is automatically allowed to exit. Network ACLs act as a firewall for associated subnets, controlling traffic entering and leaving the subnet. They are stateless, meaning return traffic must be explicitly allowed by a corresponding rule.
Step-by-Step Solution
Key Concept
Stateful Security Groups vs. Stateless Network ACLs
Estimated Time:1m 0s