A logistics company is setting up its virtual private cloud (VPC) on AWS. The network administrator needs to ensure that return traffic for allowed inbound requests to EC2 instances is permitted automatically without needing explicit outbound rules. However, they also need a secondary layer at the subnet boundary that can explicitly block all traffic from a known list of scanner IP addresses. Which network security configurations should be used to accomplish this?
- Configure a stateful Security Group at the instance level to allow return traffic automatically, and a stateless Network ACL at the subnet level to block the scanner IPs.Cevap
- BConfigure a stateless Security Group at the subnet level to allow return traffic automatically, and a stateful Network ACL at the instance level to block the scanner IPs.
- CConfigure Amazon Inspector to scan and block the scanner IPs at the subnet level, and use Amazon GuardDuty to automatically permit return traffic to the instances.
- DConfigure a Security Group to manage physical server security, and rely on AWS to manage the operating system patching of the instances.
Cevap
Configure a stateful Security Group at the instance level to allow return traffic automatically, and a stateless Network ACL at the subnet level to block the scanner IPs.
The correct option correctly identifies the roles and behaviors of Security Groups and Network ACLs. Security Groups are stateful firewalls that run at the instance level, meaning that return traffic is automatically allowed regardless of outbound rules. Network ACLs operate at the subnet level and are stateless, meaning they evaluate traffic in both directions separately and support explicit deny rules to block specific IP addresses.
Adım Adım Çözüm
Anahtar Kavram
The difference between stateful Security Groups (operating at the instance level) and stateless Network ACLs (operating at the subnet level).