Examkin

Soru

Zorluk: OrtaNetwork and Infrastructure Security

A company is configuring network security for a web application hosted on Amazon EC2 instances in a VPC. The security team has two requirements:

1. Apply rules at the subnet boundary where both inbound and outbound traffic must be explicitly allowed, as rules are evaluated independently for return traffic.
2. Apply rules at the instance boundary where allowing inbound traffic automatically permits the corresponding outbound return traffic.

Which combination of AWS security features should the company use to meet these requirements?

  1. Network Access Control Lists (NACLs) at the subnet level because they are stateless, and Security Groups at the instance level because they are statefulCevap
  2. B
    Security Groups at the subnet level because they are stateless, and Network Access Control Lists (NACLs) at the instance level because they are stateful
  3. C
    Network Access Control Lists (NACLs) at the subnet level, and Amazon Inspector at the instance level to automatically detect and block malicious network traffic
  4. D
    AWS Shield at the subnet level, and relying on AWS to automatically manage all operating system-level firewall rules on the EC2 instances

Cevap

Network Access Control Lists (NACLs) at the subnet level because they are stateless, and Security Groups at the instance level because they are stateful
The correct answer combines Network Access Control Lists (NACLs) for the subnet-level requirement and Security Groups for the instance-level requirement. NACLs are stateless firewalls that control inbound and outbound traffic at the subnet boundary, meaning outbound return traffic must be explicitly permitted. Security Groups are stateful firewalls that apply to individual EC2 instances, meaning once inbound traffic is allowed, the outbound return traffic is automatically allowed.

Adım Adım Çözüm

1
Analyze the subnet-level requirement.
The requirement states that rules must be evaluated independently for return traffic, meaning the firewall is stateless. Network Access Control Lists (NACLs) operate at the subnet boundary and are stateless.
Stateless firewalls do not keep track of connection state, so outbound return traffic must be explicitly allowed by an outbound rule.
2
Analyze the instance-level requirement.
The requirement states that allowing inbound traffic should automatically permit the corresponding outbound return traffic, meaning the firewall is stateful. Security Groups operate at the instance boundary and are stateful.
Stateful firewalls track connection state, allowing return traffic automatically without requiring an explicit outbound rule.

Anahtar Kavram

The difference between stateful Security Groups (operating at the instance level) and stateless Network Access Control Lists (operating at the subnet level).
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Network and Infrastructure Security

Bu konudan daha fazla soru