Examkin

Question

Difficulty: EasyVPC Network Security

A solutions architect is configuring network security for Amazon EC2 instances in a VPC. The instances must receive inbound HTTPS traffic from the internet and be able to send outbound requests to download updates. Which two statements correctly describe the behavior of security groups and network access control lists (network ACLs) for this traffic? (Select TWO.)

  1. A security group is stateful, which means allowing inbound HTTPS traffic automatically allows the return outbound traffic.Answer
  2. A network ACL is stateless, which means allowing inbound HTTPS traffic requires an outbound rule to allow return traffic on ephemeral ports.Answer
  3. C
    A security group is stateless, so an outbound rule must be configured to allow return traffic for the inbound HTTPS connections.
  4. D
    A network ACL is stateful, which means allowing inbound HTTPS traffic automatically allows the return outbound traffic.
  5. E
    Security groups operate at the subnet level to protect all instances, while network ACLs operate at the individual network interface level.

Answer

Security groups are stateful (allowing inbound traffic automatically allows the return outbound traffic) and network ACLs are stateless (allowing inbound traffic requires an outbound rule to allow return traffic on ephemeral ports).
Security groups are stateful firewalls. When you allow inbound HTTPS traffic, the security group tracks the connection state and automatically permits return traffic outbound. Conversely, network ACLs are stateless and do not track connection states. Therefore, allowing inbound traffic requires an explicit outbound rule to permit return traffic, which typically utilizes ephemeral ports.

Step-by-Step Solution

1
Analyze the stateful behavior of AWS Security Groups.
Security groups are stateful, meaning any inbound traffic allowed on a port (like port 443 for HTTPS) automatically allows the corresponding return outbound traffic on ephemeral ports.
This determines if security groups need explicit outbound rules for return traffic.
2
Analyze the stateless behavior of AWS Network ACLs.
Network ACLs are stateless, meaning they do not track connection states. Inbound traffic allowed must also be explicitly allowed outbound (usually using ephemeral ports 1024-65535) to let response packets return.
This determines if network ACLs need explicit outbound rules for return traffic.
3
Evaluate the scoping level of Security Groups and Network ACLs.
Security groups operate at the instance/network interface level, whereas network ACLs operate at the subnet level as a firewall.
This verifies the boundaries and application scope of both security mechanisms.

Key Concept

Stateful security groups vs stateless network ACLs
Rate this question

Topics

VPC Network Security

More questions from this topic