Question

Difficulty: EasyVPC Network Security

A solutions architect is configuring a security group for an Amazon EC2 instance that hosts a simple web server. The architect adds an inbound rule to allow TCP traffic on port 8080 from any source (0.0.0.0/00.0.0.0/0). What outbound rule must the solutions architect add to the security group to allow the HTTP response traffic to reach the clients?

  1. No outbound rule is required because security groups are stateful, meaning return traffic is automatically allowed.Answer
  2. B
    An outbound rule allowing TCP traffic to destination 0.0.0.0/00.0.0.0/0 on ephemeral ports (10241024-6553565535) is required.
  3. C
    An outbound rule allowing TCP traffic to destination 0.0.0.0/00.0.0.0/0 on port 8080 is required.
  4. D
    An outbound rule must be configured in AWS WAF to permit the response traffic, since security groups only inspect incoming packets.

Answer

No outbound rule is required because security groups are stateful, meaning return traffic is automatically allowed.
Security groups in AWS VPCs are stateful. When you create an inbound rule to allow traffic on a specific port (like port 8080), the security group automatically tracks the connection state and allows the return response traffic to flow outbound to the client. No corresponding outbound rule is required.

Step-by-Step Solution

1
Identify the type of firewalls being configured.
The architect is configuring an AWS Security Group at the EC2 instance level.
Determining the security resource type is critical because Security Groups and Network ACLs exhibit different connection-tracking behaviors.
2
Apply the stateful connection-tracking behavior of Security Groups.
Security groups are stateful. Once inbound traffic is allowed on port 8080, return traffic is automatically permitted.
This explains why no outbound rule is necessary to send responses back to the clients.

Key Concept

AWS Security Groups are stateful firewalls that operate at the instance level. They automatically track connection states and allow return traffic without requiring matching outbound rules.
Rate this question