Examkin

Soru

Zorluk: KolayNetwork and Infrastructure Security

A developer is deploying a backend database within an Amazon VPC and needs to restrict access so that only the application tier can communicate with it. The developer wants a security control that operates at the instance level and automatically allows return traffic for any established inbound connection. Which AWS security feature should the developer implement?

  1. Security groupsCevap
  2. B
    Network access control lists (network ACLs)
  3. C
    Amazon GuardDuty
  4. D
    AWS Shield

Cevap

Security groups
The correct answer is security groups. Security groups act as a virtual firewall for your EC2 instances to control incoming and outgoing traffic. They are stateful, which means that if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. Similarly, if inbound traffic is allowed, return outbound traffic is automatically allowed.

Adım Adım Çözüm

1
Identify the level of security control required by the scenario.
The scenario requires an instance-level firewall rather than a subnet-level control.
This narrows the choice down to security groups, as network ACLs operate at the subnet level.
2
Determine the statefulness behavior of the required control.
The firewall must automatically allow outbound return traffic for any established inbound connection, which is the definition of stateful behavior.
Security groups are stateful and automatically permit return traffic, satisfying both the instance-level and stateful requirements.

Anahtar Kavram

Security groups are stateful, instance-level firewalls in Amazon VPC, whereas Network ACLs are stateless, subnet-level firewalls.
Bu soruyu puanla

Konular

Network and Infrastructure Security

Bu konudan daha fazla soru