Examkin

Question

Difficulty: EasyVPC Network Security

A solutions architect is designing the network security for a new application hosted on Amazon EC2 instances in a VPC. The architect needs to implement a stateful firewall at the instance level that automatically allows return traffic for any allowed inbound request. Which VPC security feature should the solutions architect use to meet this requirement?

  1. Security GroupsAnswer
  2. B
    Network Access Control Lists (Network ACLs)
  3. C
    AWS Web Application Firewall (AWS WAF)
  4. D
    AWS Shield Standard

Answer

Security Groups
The correct option is the one specifying Security Groups. Security Groups act as a stateful firewall for Amazon EC2 instances, meaning any allowed inbound connection automatically allows the outbound response traffic to flow back to the client.

Step-by-Step Solution

1
Identify the level of security control required by the scenario.
The requirement specifies an instance-level firewall.
Security Groups operate at the instance or elastic network interface (ENI) level, whereas Network ACLs operate at the subnet level.
2
Determine the statefulness requirement.
The requirement specifies a stateful firewall that automatically allows return traffic.
Security Groups are stateful (automatically allowing return traffic), while Network ACLs are stateless (requiring explicit inbound and outbound rules).

Key Concept

Security Groups function as stateful firewalls at the Amazon EC2 instance level, automatically allowing response traffic for allowed requests.
Rate this question

Topics

VPC Network Security

More questions from this topic