An organization is configuring a secure network architecture on AWS with public-facing web servers and a private database tier. To meet strict compliance guidelines, the security team must implement a layered defense-in-depth strategy. They need to understand how Security Groups and Network Access Control Lists (Network ACLs) behave when filtering traffic across these tiers.
Which of the following statements accurately describe the behavior and configuration of Security Groups and Network ACLs in this scenario? (Select TWO.)
- ANetwork ACLs operate at the instance level (Elastic Network Interface), allowing fine-grained rule applications to individual EC2 instances.
- Security groups are stateful, meaning that if an inbound HTTP request is allowed on port 80, the outbound response traffic is automatically allowed regardless of outbound security group rules.Cevap
- CUnder the AWS Shared Responsibility Model, AWS is responsible for configuring and maintaining the specific inbound and outbound rules inside the customer's Network ACLs to prevent external intrusions.
- Network ACLs are stateless, requiring explicit rules in both directions (inbound and outbound) to allow traffic to flow between subnets.Cevap
- EAmazon Inspector must be deployed to monitor active traffic flows passing through the Network ACLs and automatically block malicious IP addresses.
Cevap
Security groups are stateful (allowing return traffic automatically) and Network ACLs are stateless (requiring explicit inbound and outbound rules).
Security groups operate at the instance level and are stateful. When inbound traffic is allowed, corresponding outbound traffic is permitted automatically. Conversely, Network ACLs operate at the subnet level and are stateless, meaning return traffic must be explicitly permitted by a rule in the opposite direction.
Adım Adım Çözüm
Anahtar Kavram
Statefulness versus statelessness and subnet-level versus instance-level enforcement of AWS network security controls.