Examkin

Question

Difficulty: EasyVPC Network Security

A solutions architect is configuring network security for a standard multi-tier application within an Amazon VPC. The architect needs to establish the proper boundaries using Security Groups and Network Access Control Lists (Network ACLs). Which of the following statements correctly describe the characteristics of Security Groups and Network ACLs? (Select TWO.)

  1. Security groups are stateful, so allowed inbound traffic automatically permits return outbound traffic.Answer
  2. Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed.Answer
  3. C
    Security groups operate at the subnet level and apply to all instances within that subnet.
  4. D
    Network ACLs operate at the network interface level to protect individual EC2 instances.
  5. E
    Security groups evaluate rules in numbered order starting with the lowest number.

Answer

Security groups are stateful, so allowed inbound traffic automatically permits return outbound traffic, and Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed.
Security groups are stateful, which means any traffic allowed inbound is automatically allowed to return outbound, regardless of outbound rules. Network ACLs are stateless, meaning they evaluate traffic inbound and outbound independently, requiring explicit rules in both directions.

Step-by-Step Solution

1
Analyze the statefulness of Security Groups and Network ACLs.
Security groups are stateful (inbound allows outbound response), whereas Network ACLs are stateless (both directions require rules).
This establishes the basic traffic evaluation behavior of the two network security layers.
2
Analyze the scope of application for each component.
Security groups apply at the instance or Elastic Network Interface (ENI) level. Network ACLs apply at the subnet boundary level.
This determines where the traffic filtering takes place in the VPC topology.
3
Evaluate rule processing methods.
Security groups evaluate all rules together, allowing traffic if any rule matches. Network ACLs evaluate rules in numerical order, applying the first match.
This clarifies how rules are matched and executed for both controls.

Key Concept

VPC Network Security layer differences (Security Groups vs Network ACLs)
Rate this question

Topics

VPC Network Security

More questions from this topic