Examkin

Question

Difficulty: EasyVPC Network Security

A company is designing a secure network architecture on AWS. The solutions architect needs to implement a security barrier that controls inbound and outbound traffic at the subnet boundary for all resources within that subnet. Which AWS feature should the architect configure to meet this requirement?

  1. Network Access Control Lists (Network ACLs)Answer
  2. B
    Security Groups
  3. C
    AWS WAF
  4. D
    AWS Shield

Answer

Network Access Control Lists (Network ACLs)
Network Access Control Lists (Network ACLs) serve as a stateless firewall for controlling traffic in and out of one or more subnets, making them the correct choice for enforcing controls at the subnet boundary.

Step-by-Step Solution

1
Identify the target boundary for the network security control.
The requirement states that the barrier must operate at the subnet boundary.
This helps distinguish between network-level firewalls and host-level firewalls.
2
Evaluate the capabilities of the available AWS network security tools.
Security groups apply to elastic network interfaces (ENIs) at the instance level. Network ACLs are associated directly with subnets and process all traffic crossing the subnet boundaries.
Matching the boundary requirement ensures the correct security feature is selected.

Key Concept

Subnet-level network security controls
Estimated Time:45s
Rate this question

Topics

VPC Network Security

More questions from this topic