Examkin

Question

Difficulty: EasyVPC Network Security

An Amazon EC2 instance in a private subnet needs to make outbound HTTPS requests to an external API. The security group associated with the instance is configured with an outbound rule that allows traffic to any destination on port 443443. There are no inbound rules configured on the security group. How does the security group handle the response traffic from the external API?

  1. The response traffic is automatically allowed because security groups are stateful.Answer
  2. B
    The response traffic is blocked because security groups are stateless and require an explicit inbound rule for port 443443.
  3. C
    The response traffic is blocked because security groups operate at the subnet level and must allow return traffic for the entire CIDR block.
  4. D
    The response traffic is blocked by default because AWS Shield Standard blocks all inbound internet traffic to private subnets.

Answer

The response traffic is automatically allowed because security groups are stateful.
The correct answer is that the response traffic is automatically allowed. Because security groups in Amazon VPC are stateful, any traffic that is explicitly allowed outbound is automatically allowed back inbound, bypassing the need for a corresponding inbound rule.

Step-by-Step Solution

1
Analyze the resource and rules configuration.
The EC2 instance uses a security group with an outbound rule allowing port 443443 but no inbound rules.
To determine how return traffic is treated, we must evaluate the statefulness of the security control.
2
Determine the statefulness behavior of security groups.
Security groups are stateful. This means any allowed outbound connection will automatically permit the corresponding inbound response traffic.
Stateful packet filtering tracks the connection state and permits return traffic without requiring a matching rule in the opposite direction.

Key Concept

Security Group Statefulness
Rate this question

Topics

VPC Network Security

More questions from this topic