Examkin

Question

Difficulty: MediumNetwork and Infrastructure Security

A media streaming startup is configuring network security for its delivery servers within an Amazon VPC. The system administrator needs to block traffic from a list of known malicious IP addresses at the subnet boundary. The administrator must also manually define both inbound and outbound rules because the firewall does not automatically allow return traffic. Which AWS feature meets these requirements?

  1. Network Access Control Lists (Network ACLs)Answer
  2. B
    Security Groups
  3. C
    Amazon GuardDuty
  4. D
    AWS Shield

Answer

Network Access Control Lists (Network ACLs)
Network Access Control Lists (Network ACLs) operate at the subnet boundary and are stateless. This means that both inbound traffic and outbound response traffic must be explicitly defined in the rules. Additionally, they support explicit deny rules to block specific IP addresses.

Step-by-Step Solution

1
Analyze the operational boundary required for the network firewall.
The firewall must operate at the subnet boundary rather than the individual instance level.
This rules out Security Groups, which act at the instance level, and focuses attention on Network ACLs.
2
Evaluate the stateful or stateless behavior required for the traffic control.
The requirement states that return traffic is not automatically allowed, necessitating explicit outbound rules.
This indicates stateless behavior, which is a defining characteristic of Network ACLs.

Key Concept

Network ACLs are stateless firewalls operating at the subnet level that can explicitly allow or deny traffic based on IP addresses.
Estimated Time:1m 0s
Rate this question

Topics

Network and Infrastructure Security

More questions from this topic