Examkin

Question

Difficulty: EasyAWS Network Services

An application developer is deploying an online portal on an Amazon EC2 instance. To meet security requirements, the developer must permit incoming traffic only on HTTPS port 443 and ensure that all return traffic is automatically allowed without configuring additional rules. Which AWS networking feature should the developer configure directly on the instance to meet these requirements?

  1. A
    Network Access Control List (Network ACL)
  2. Security GroupAnswer
  3. C
    AWS Transit Gateway
  4. D
    Amazon GuardDuty

Answer

Security Group
The security group is the correct answer because it operates at the instance level and is stateful. Stateful firewalls automatically allow return traffic for any established connection, eliminating the need to write separate outbound rules for inbound requests.

Step-by-Step Solution

1
Analyze the traffic scope and control level required by the scenario.
The requirement specifies controlling traffic directly on the instance (instance-level firewall) and automatically allowing return traffic (stateful behavior).
AWS provides firewalls at different levels: security groups at the instance level and network ACLs at the subnet level.
2
Compare the characteristics of Security Groups and Network ACLs.
Security groups are stateful and apply to instances, while Network ACLs are stateless and apply to subnets.
Since the scenario requires stateful behavior (return traffic automatically allowed) at the instance level, a security group is the only matching option.

Key Concept

VPC security features including Security Groups and Network ACLs
Rate this question

Topics

AWS Network Services

More questions from this topic