Examkin

Question

Difficulty: EasyVPC Network Security

A solutions architect is configuring network security controls for a new application within a VPC. The architect needs to understand the default behavior of the default security group and the default network access control list (NACL). Which of the following statements accurately describe the default configurations of these resources? (Select TWO.)

  1. The default security group allows all inbound traffic originating from resources associated with that same security group.Answer
  2. The default network ACL allows all inbound and outbound traffic.Answer
  3. C
    The default security group blocks all outbound traffic until an outbound rule is explicitly added.
  4. D
    The default network ACL is stateful, meaning any allowed inbound traffic automatically permits the corresponding return outbound traffic.
  5. E
    The default security group operates at the subnet level to block traffic from specific IP addresses.

Answer

The correct answers are the options stating that the default security group allows all inbound traffic from resources associated with the same security group, and that the default network ACL allows all inbound and outbound traffic.
The default security group is configured to allow inbound traffic only if it originates from resources that are associated with the same security group. All other inbound traffic is blocked. Meanwhile, the default network ACL is preconfigured to allow all inbound and outbound traffic, acting as a pass-through until custom rules are written.

Step-by-Step Solution

1
Analyze security group default configuration rules.
The default security group allows all outbound traffic and allows inbound traffic only from resources associated with the same security group.
This establishes the baseline behavior for instances launched into the default security group.
2
Analyze network ACL default configuration rules.
The default network ACL allows all traffic to pass both inbound and outbound.
This ensures that subnets associated with the default NACL do not have traffic blocked until custom rules are defined.
3
Differentiate security group and network ACL characteristics.
Identify that security groups are stateful and operate at the interface level, while network ACLs are stateless and operate at the subnet level.
This filters out incorrect options that confuse statefulness and placement levels.

Key Concept

Default VPC Network Security Configurations
Rate this question

Topics

VPC Network Security

More questions from this topic