A company is designing the network security architecture for a new web application deployed across multiple subnets in a Virtual Private Cloud (VPC). The cloud practitioner needs to configure instance-level firewalls that automatically allow return traffic for established connections, as well as subnet-level firewalls where rules must be explicitly configured for both inbound and outbound traffic.
Which of the following AWS network security features should be configured to meet these requirements? (Select TWO.)
- Security groups to control traffic at the instance levelCevap
- Network access control lists (network ACLs) to control traffic at the subnet levelCevap
- CSecurity groups to act as stateless firewalls controlling traffic at the subnet level
- DNetwork access control lists (network ACLs) to act as stateful firewalls controlling traffic at the instance level
- EAmazon Inspector to automatically filter and block unauthorized network traffic at the subnet boundary
Cevap
Security groups should be configured to control traffic at the instance level, and network access control lists (network ACLs) should be configured to control traffic at the subnet level.
Security groups operate at the instance level (specifically the elastic network interface) and are stateful, meaning any allowed inbound request automatically allows return outbound traffic. Network Access Control Lists (network ACLs) operate at the subnet level and are stateless, meaning rules must be explicitly defined for both inbound and outbound traffic to allow return communication.
Adım Adım Çözüm
Anahtar Kavram
The difference between stateful security groups operating at the instance level and stateless network ACLs operating at the subnet level.
Tahmini Süre:1m 30s