Examkin

Question

Difficulty: EasyVPC Network Security

A company is deploying an in-memory caching tier in a private subnet within an Amazon VPC. The caching nodes run on Amazon EC2 instances and use port 63796379. Only the application servers running in the web subnet should be allowed to read from and write to the cache nodes. A solutions architect needs to restrict network access to the caching tier.

Which two configuration steps should the solutions architect perform to secure the caching tier? (Select TWO.)

  1. Create a security group for the caching instances that allows inbound TCP traffic on port 63796379 from the security group associated with the application instances.Answer
  2. Rely on the stateful behavior of the caching instances' security group to automatically allow the outbound return traffic back to the application instances.Answer
  3. C
    Configure an outbound rule in the caching instances' security group that explicitly allows TCP traffic on ephemeral ports to the application instances, since security groups are stateless.
  4. D
    Deploy AWS WAF at the caching subnet level to inspect and block unauthorized layer 77 commands sent to the caching instances.
  5. E
    Create a network ACL for the caching subnet that allows inbound TCP traffic on port 63796379 but blocks outbound traffic on all ephemeral ports to keep the subnet private.

Answer

The solutions architect should create a security group for the caching instances allowing inbound traffic on port 63796379 from the application security group, and rely on the stateful nature of security groups to permit return traffic.
To secure the caching tier, the caching instances must have a security group that explicitly allows inbound traffic on port 63796379 from the application instances' security group. Because security groups are stateful, outbound response traffic from the caching instances to the application instances is permitted automatically, without requiring explicit outbound rules.

Step-by-Step Solution

1
Identify the resource-level firewall requirements.
Determine that security groups should be used for fine-grained instance-level traffic control.
Security groups act as a firewall for associated EC2 instances, allowing traffic to be restricted by port and source security group.
2
Configure the inbound security group rules for the caching instances.
Allow TCP port 63796379 from the application security group ID.
This establishes least-privilege access, ensuring only application instances can communicate with the caching tier.
3
Leverage the stateful nature of security groups for return traffic.
Do not configure any additional inbound or outbound rules for the return traffic.
Because security groups are stateful, allowing inbound request traffic automatically allows the outbound response traffic.

Key Concept

Security groups are stateful, resource-level firewalls that can reference other security groups as sources, whereas network ACLs are stateless, subnet-level firewalls.
Rate this question

Topics

VPC Network Security

More questions from this topic