Examkin

Question

Difficulty: MediumVPC Network Security

An organization is deploying a microservices-based application where a backend service runs on Amazon EC2 instances in a private subnet. An integration proxy instance in the public subnet of the same VPC needs to forward incoming customer requests to these backend instances. The company's security policy requires that the backend instances must not be allowed to initiate any outbound connections to the internet or other subnets, but they must be able to receive requests from the integration proxy and return the responses. Which configuration should a solutions architect implement to meet these security requirements?

  1. Associate a security group with the backend EC2 instances that allows inbound traffic from the integration proxy's security group, and remove all outbound rules from this security group.Answer
  2. B
    Associate a Network ACL with the private subnet that allows inbound traffic from the public subnet, and remove all outbound rules from the Network ACL to prevent any outbound connection initiation.
  3. C
    Associate a security group with the backend EC2 instances that allows inbound traffic from the integration proxy's security group, and associate an AWS WAF web ACL with the private subnet's route table to block outbound requests.
  4. D
    Associate a security group with the backend EC2 instances that allows inbound traffic from the integration proxy's security group, and configure a Network ACL on the private subnet that denies all outbound traffic on ports 10241024 to 6553565535.

Answer

Associate a security group with the backend EC2 instances that allows inbound traffic from the integration proxy's security group, and remove all outbound rules from this security group.
The correct option correctly leverages the stateful nature of security groups. In a VPC, security groups are stateful, meaning any inbound traffic allowed by an inbound rule is automatically permitted to flow out as return traffic, bypassing outbound rules. By removing all outbound rules from the backend security group, the instances are blocked from initiating any outbound connections (e.g., to the internet or other resources), satisfying the security policy while still allowing the instances to respond to incoming requests from the integration proxy.

Step-by-Step Solution

1
Analyze the statefulness of security groups.
VPC security groups are stateful. This means that if an inbound request is permitted, the corresponding response is automatically allowed to flow out, regardless of any outbound security group rules.
To understand how return traffic will behave when outbound rules are modified.
2
Evaluate the requirement to prevent initiated outbound connections.
Removing all outbound rules from the security group ensures the EC2 instances cannot initiate any outbound sessions (e.g., to the internet or other internal resources).
To satisfy the least privilege security policy of preventing outbound-initiated connections.
3
Differentiate between security groups and Network ACLs (NACLs).
NACLs are stateless and apply at the subnet boundary. Restricting outbound traffic in a NACL (either completely or on ephemeral ports 10241024 to 6553565535) would block the response traffic of the allowed inbound connections, making it unsuitable for this scenario.
To rule out the incorrect NACL-based options.

Key Concept

Stateful vs Stateless VPC Security Controls
Rate this question

Topics

VPC Network Security

More questions from this topic