A company is designing the network security architecture for a new web application within an Amazon Virtual Private Cloud (Amazon VPC). The security team requires using both security groups and network access control lists (NACLs) to protect their resources. Which of the following statements correctly describe the characteristics of these AWS network security features? (Select TWO.)
- Security groups are stateful, meaning that if an inbound request is allowed, the outbound return traffic is automatically permitted.Answer
- Network ACLs operate at the subnet level to control traffic flowing in and out of the associated subnets.Answer
- CSecurity groups operate at the subnet level to protect all resources residing inside the same subnet.
- DNetwork ACLs are stateful, meaning they automatically permit response traffic for any established connection.
- ESecurity groups support both allow rules and deny rules to explicitly block specific IP addresses from reaching resources.
Answer
Security groups are stateful, meaning that if an inbound request is allowed, the outbound return traffic is automatically permitted; and Network ACLs operate at the subnet level to control traffic flowing in and out of the associated subnets.
The correct options are that security groups are stateful, meaning that return traffic is automatically allowed, and network ACLs operate at the subnet level. Security groups function as virtual firewalls at the instance level, and their stateful nature ensures that if traffic is allowed in one direction, response traffic is automatically allowed. Network ACLs function at the subnet boundary and apply to all resources inside the subnet.
Step-by-Step Solution
Key Concept
AWS VPC Network Security (Security Groups vs. Network ACLs)