An organization is designing the network security architecture for a multi-tier application in an Amazon VPC. The database tier resides in a private subnet, while the web tier is in a public subnet. The security team needs to implement controls to restrict inbound and outbound traffic at both the subnet boundary and the individual Amazon EC2 instance level. Which of the following statements correctly describe the characteristics of Security Groups and Network Access Control Lists (Network ACLs) in this architecture? (Select TWO.)
- Security Groups are stateful, meaning if an inbound rule allows traffic to reach a database instance, the outbound response is permitted automatically.Cevap
- Network ACLs are stateless, meaning if an inbound rule allows traffic into a subnet, a corresponding outbound rule must be configured to allow the return traffic.Cevap
- CNetwork ACLs operate at the EC2 instance level to filter traffic, while Security Groups operate at the subnet level to protect the entire boundary.
- DAWS is responsible for managing and patching host operating system firewalls on customer-provisioned Amazon EC2 instances under the Shared Responsibility Model.
- EAmazon GuardDuty acts as an active firewall that can automatically detect and block malicious traffic at the subnet boundary.
Cevap
Security Groups are stateful, so inbound rules automatically permit outbound response traffic, while Network ACLs are stateless, requiring explicit inbound and outbound rules to allow return traffic.
Security Groups are stateful, meaning outbound response traffic is permitted automatically if inbound traffic is allowed. In contrast, Network ACLs are stateless, requiring explicit configuration of both inbound and outbound rules to allow return traffic.
Adım Adım Çözüm
Anahtar Kavram
Stateful Security Groups vs. Stateless Network ACLs
Tahmini Süre:1m 30s