Examkin

Soru

Zorluk: OrtaAWS Network Services

An organization needs to secure a web application deployed on Amazon EC2 instances. The security administrator must implement a rule to block traffic from a specific malicious IP address before it enters the subnet. Additionally, the administrator wants to allow incoming HTTP traffic to the EC2 instances such that return traffic is automatically allowed without requiring an outbound rule.

Which of the following Amazon VPC security features should the administrator configure to meet these requirements? (Select TWO.)

  1. Security GroupsCevap
  2. Network Access Control Lists (Network ACLs)Cevap
  3. C
    AWS WAF (Web Application Firewall)
  4. D
    AWS Transit Gateway
  5. E
    VPC Peering

Cevap

Security Groups and Network Access Control Lists (Network ACLs)
The correct options are Security Groups and Network Access Control Lists (Network ACLs). Network ACLs act as a stateless firewall at the subnet level and allow the configuration of explicit deny rules to block a specific malicious IP address before traffic reaches the EC2 instances. Security Groups act as a stateful firewall at the instance level, meaning that once inbound HTTP traffic is permitted, the return outbound traffic is automatically allowed without requiring a matching outbound rule.

Adım Adım Çözüm

1
Identify the service needed to block traffic from a specific malicious IP address before it enters the subnet.
Network Access Control Lists (Network ACLs) operate at the subnet level and support explicit deny rules, which allows blocking specific IP addresses.
Security groups do not support deny rules and operate at the instance level rather than the subnet level.
2
Identify the service needed to allow incoming HTTP traffic to EC2 instances such that return traffic is automatically allowed.
Security Groups are stateful firewalls operating at the instance level. Because they are stateful, allowing inbound traffic automatically allows the return outbound traffic.
Network ACLs are stateless, meaning outbound return traffic must be explicitly allowed by outbound rules.

Anahtar Kavram

Understanding the differences between Security Groups (stateful, instance-level, allow-only rules) and Network ACLs (stateless, subnet-level, allow and deny rules) for securing an Amazon VPC environment.
Bu soruyu puanla

Konular

AWS Network Services

Bu konudan daha fazla soru