A gaming company is deploying matchmaking servers on Amazon EC2 instances within a Virtual Private Cloud (VPC). The network security architecture must meet the following requirements:
1. Control traffic at the individual instance level, ensuring that return traffic for allowed inbound requests is automatically permitted.
2. Control traffic at the subnet boundary, acting as a secondary layer of defense that requires explicit rules for both inbound and outbound traffic.
Which two AWS network security features should the company implement to meet these requirements? (Select TWO.)
- Security GroupsCevap
- Network Access Control Lists (NACLs)Cevap
- CAWS WAF
- DAmazon GuardDuty
- EAWS Shield
Cevap
Security Groups and Network Access Control Lists (NACLs)
The correct choices are Security Groups and Network Access Control Lists (NACLs). Security Groups act as a firewall for EC2 instances and are stateful, meaning any allowed inbound traffic automatically permits the corresponding outbound return traffic. Network Access Control Lists (NACLs) act as a firewall at the subnet boundary and are stateless, meaning return traffic must be explicitly allowed by configuring both inbound and outbound rules.
Adım Adım Çözüm
Anahtar Kavram
Understanding the differences between Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level) in AWS VPC security.
Tahmini Süre:1m 30s