A retail company is deploying a secure three-tier application within an Amazon VPC. The operations team needs to understand how to apply firewall-like controls at both the instance level and the subnet boundary. Which two of the following statements accurately describe the characteristics and behavior of Security Groups and Network Access Control Lists (Network ACLs) in this environment?
- Security groups are stateful, meaning that allowed inbound traffic automatically permits the corresponding outbound response traffic.Cevap
- Network ACLs are stateless, meaning that outbound response traffic must be explicitly allowed by a corresponding outbound rule.Cevap
- CSecurity groups operate at the subnet level to filter traffic for all instances within that subnet.
- DNetwork ACLs are stateful, automatically allowing return traffic once an inbound request is permitted.
- EAmazon GuardDuty automatically updates Security Group rules to block malicious traffic at the instance level.
Cevap
Security groups are stateful, allowing corresponding outbound response traffic automatically, and Network ACLs are stateless, requiring return traffic to be explicitly allowed by an outbound rule.
Security groups are stateful network firewalls that operate at the instance level; once inbound traffic is allowed, return outbound traffic is permitted automatically. In contrast, Network ACLs operate at the subnet level and are stateless, requiring explicit outbound rules to permit return traffic.
Adım Adım Çözüm
Anahtar Kavram
Stateful vs. Stateless Network Security in AWS VPC