Examkin

Question

Difficulty: EasyVPC Network Security

A solutions architect is configuring the network security settings for resources within an Amazon VPC. The architect needs to establish controls using both security groups and network access control lists (network ACLs). Which TWO of the following statements correctly describe the characteristics of security groups and network ACLs?

  1. Security groups are stateful, meaning that return traffic is automatically allowed.Answer
  2. Network ACLs are stateless, meaning that return traffic must be explicitly allowed by outbound rules.Answer
  3. C
    Security groups operate at the subnet level to protect all resources residing within the subnet.
  4. D
    Network ACLs are stateful, allowing return traffic automatically once the inbound request is approved.
  5. E
    Security groups support both allow rules and explicit deny rules to block specific external IP addresses.

Answer

Security groups are stateful, meaning that return traffic is automatically allowed, and network ACLs are stateless, meaning that return traffic must be explicitly allowed by outbound rules.
The correct statements are that security groups are stateful and network ACLs are stateless. When traffic is permitted inbound through a security group, the return outbound traffic is automatically allowed. Conversely, network ACLs do not track session states, so return traffic must be explicitly permitted by a corresponding outbound rule.

Step-by-Step Solution

1
Determine the statefulness of both security groups and network ACLs.
Security groups are stateful (inbound allows outbound response), and network ACLs are stateless (both paths must be explicitly configured).
This is a fundamental operational difference between the two security layers.
2
Identify the boundary or level at which each security feature operates.
Security groups operate at the resource/instance level, whereas network ACLs operate at the subnet boundary level.
Correctly applying rules requires knowing whether they affect specific instances or the entire subnet.
3
Analyze the rule actions supported by each feature.
Security groups only support allow rules, whereas network ACLs support both allow and deny rules.
This determines how explicit blocklists or default-deny configurations should be implemented.

Key Concept

Operational differences, statefulness, and boundary levels of Security Groups and Network ACLs
Estimated Time:1m 0s
Rate this question

Topics

VPC Network Security

More questions from this topic