Examkin

Soru

Zorluk: ZorNetwork and Infrastructure Security

A company is hosting a secure web application on Amazon EC2 instances located in a public subnet. To implement a defense-in-depth strategy, the network team uses both Security Groups and Network Access Control Lists (Network ACLs). External clients must be allowed to access the application over HTTPS (port 443), while all other inbound traffic must be blocked. Which two configurations are required to allow this traffic to flow successfully to and from the instances?

  1. Add an inbound rule to the instance's Security Group that allows TCP traffic on port 443 from 0.0.0.0/0.Cevap
  2. Add an outbound rule to the subnet's Network ACL that allows TCP traffic on ephemeral ports (1024–65535) to 0.0.0.0/0.Cevap
  3. C
    Add an outbound rule to the instance's Security Group that allows TCP traffic on ephemeral ports (1024–65535) to 0.0.0.0/0.
  4. D
    Add an inbound rule to the subnet's Network ACL that allows TCP traffic on port 443, and rely on its stateful nature to automatically permit the return traffic.
  5. E
    Associate the Network ACL directly with the EC2 instances, while applying the Security Group to the public subnet.

Cevap

Add an inbound rule to the instance's Security Group that allows TCP traffic on port 443 from 0.0.0.0/0, and add an outbound rule to the subnet's Network ACL that allows TCP traffic on ephemeral ports (1024–65535) to 0.0.0.0/0.
To allow external HTTPS traffic to reach the EC2 instances and return successfully, two levels of evaluation must be satisfied. First, at the instance level, the stateful Security Group must permit inbound traffic on TCP port 443. Because it is stateful, the return traffic is automatically allowed. Second, at the subnet level, the stateless Network ACL must permit both the inbound request on TCP port 443 and the outbound response. Since the client establishes the connection, the response traffic travels back to the client's ephemeral port range (typically 1024–65535), which must be explicitly permitted by an outbound rule in the Network ACL.

Adım Adım Çözüm

1
Identify the security components and their levels of operation.
Security Groups operate at the instance/network interface level, while Network ACLs operate at the subnet level.
Understanding the boundaries is necessary to apply the rules to the correct resource type.
2
Analyze the statefulness of the Security Group for the inbound request.
Since Security Groups are stateful, adding an inbound rule for TCP port 443 from any source (0.0.0.0/0) is sufficient to allow both the request and the automated response traffic.
Stateful firewalls track connections and automatically allow return traffic.
3
Analyze the statelessness of the Network ACL for the response traffic.
Since Network ACLs are stateless, they evaluate inbound and outbound traffic independently. In addition to allowing inbound TCP 443, an outbound rule must be configured to allow traffic returning to the client's ephemeral ports (1024–65535).
Stateless firewalls do not track connection states, so return traffic must be explicitly allowed.

Anahtar Kavram

The difference between stateful Security Groups (operating at the instance level) and stateless Network ACLs (operating at the subnet level).
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Network and Infrastructure Security

Bu konudan daha fazla soru