Security and Compliance

441 questions

All types441 Multiple choice225 Multiple select216

A financial services firm is deploying a trade processing application on Amazon EC2 instances within a private subnet. The system architecture requires separating instance-level traffic control from subnet-level boundaries. Which of the following statements accurately describe how the administrator should configure Security Groups and Network Access Control Lists (Network ACLs) for this environment? (Select TWO.)

Select all that apply

Security groups are stateful, meaning return traffic is automatically allowed, and they are applied at the instance level.

Network ACLs are stateless, meaning separate inbound and outbound rules are required to allow traffic, and they are applied at the subnet level.

Network ACLs are stateful, meaning they automatically track connection state and allow return traffic at the subnet level.

AWS is responsible for managing security group rules and Network ACL rules on behalf of the customer under the Shared Responsibility Model.

Amazon Inspector should be configured to analyze VPC Flow Logs for intelligent threat detection and block malicious traffic at the subnet level.

Show answer & explanation

Answer: Security groups are stateful, meaning return traffic is automatically allowed, and they are applied at the instance level.; Network ACLs are stateless, meaning separate inbound and outbound rules are required to allow traffic, and they are applied at the subnet level.

Answer

The correct options are: 'Security groups are stateful, meaning return traffic is automatically allowed, and they are applied at the instance level' and 'Network ACLs are stateless, meaning separate inbound and outbound rules are required to allow traffic, and they are applied at the subnet level'.

The correct options accurately describe the basic properties and boundaries of AWS network security firewalls. Security groups are stateful firewalls operating at the instance level (automatically allowing return traffic). Network ACLs are stateless firewalls operating at the subnet level (requiring separate inbound and outbound configuration).

Step-by-Step Solution

Analyze the request to separate instance-level traffic control from subnet-level boundaries.

Identify that Security Groups operate at the instance level and Network ACLs operate at the subnet level.

This establishes the correct architectural boundaries for each service.

Evaluate the stateful vs. stateless properties of both firewalls.

Determine that Security Groups automatically allow return traffic (stateful), whereas Network ACLs require explicit configuration for both directions (stateless).

This ensures network configurations do not inadvertently block legitimate return traffic.

Key Concept

AWS Network security involves layering Security Groups (instance-level, stateful) and Network ACLs (subnet-level, stateless) to achieve defense in depth.

PreviousPage 23 / 23

Security and Compliance

Answer

Step-by-Step Solution

Key Concept

Common Mistakes