Examkin

Question

Difficulty: EasyVPC Network Security

A system administrator is reviewing the network access controls for a new application environment within an Amazon VPC. The administrator wants to ensure that the security groups and network access control lists (network ACLs) are configured correctly. Which TWO statements accurately describe the traffic-filtering behavior of these security components? (Select TWO.)

  1. A security group automatically permits outbound return traffic for any allowed inbound connection.Answer
  2. A network ACL requires a separate outbound rule to allow the return traffic of a permitted inbound connection.Answer
  3. C
    A newly created custom network ACL automatically allows all inbound and outbound traffic by default.
  4. D
    A newly created security group automatically permits all inbound traffic from any source by default.
  5. E
    A network ACL is associated directly with individual Elastic Network Interfaces (ENIs) of EC2 instances to filter traffic.

Answer

Security groups automatically permit outbound return traffic for any allowed inbound connection, and network ACLs require a separate outbound rule to allow the return traffic of a permitted inbound connection.
The correct options accurately describe that security groups automatically permit outbound return traffic for any allowed inbound connection due to their stateful nature, and network ACLs require a separate outbound rule to allow the return traffic of a permitted inbound connection because they are stateless.

Step-by-Step Solution

1
Analyze security group connection tracking behavior.
Security groups are stateful. When traffic is permitted in one direction, the return traffic is automatically allowed.
This is a fundamental design feature of AWS security groups to simplify rule management for established connections.
2
Analyze network ACL connection tracking behavior.
Network ACLs are stateless. Each rule evaluates packets independently without keeping track of the connection state.
Because they are stateless, returning response packets require an explicit rule matching their port and destination to pass through.
3
Evaluate the remaining options regarding default configurations and association scopes.
Custom network ACLs deny all traffic by default, newly created security groups deny all inbound traffic by default, and network ACLs apply at the subnet level rather than the network interface level.
Correctly identifying these configurations avoids common misconceptions about AWS VPC network security default behaviors.

Key Concept

Stateful vs. stateless traffic filtering in Amazon VPC using Security Groups and Network ACLs
Estimated Time:1m 0s
Rate this question

Topics

VPC Network Security

More questions from this topic