Examkin

Soru

Zorluk: OrtaAWS Network Services

A team is setting up a database subnet in an Amazon VPC and needs to block all inbound traffic from a specific malicious IP address before it reaches any resource within that subnet. Which AWS firewall feature should they configure to enforce this subnet-level, stateless traffic filtering?

  1. Network Access Control ListCevap
  2. B
    Security group
  3. C
    VPC peering connection
  4. D
    AWS Transit Gateway

Cevap

Network Access Control List
A Network Access Control List (NACL) is the correct choice because it functions as a stateless firewall at the subnet level and allows the creation of explicit deny rules to block specific IP addresses.

Adım Adım Çözüm

1
Identify the scope and rule requirements.
The requirement specifies blocking traffic at the subnet level and filtering a specific IP address using a firewall control.
This helps determine whether an instance-level or subnet-level control is needed, and whether deny rules are supported.
2
Evaluate AWS firewall features against the requirements.
Network Access Control Lists (NACLs) are stateless, operate at the subnet level, and support explicit deny rules. Security groups are stateful, operate at the instance level, and support only allow rules.
Choosing the correct feature requires mapping the stateless and subnet-level characteristics of NACLs to the requirement of blocking an IP address before it enters the subnet.

Anahtar Kavram

Subnet-level stateless filtering using Network Access Control Lists (NACLs)
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

AWS Network Services

Bu konudan daha fazla soru