Examkin

Soru

Zorluk: OrtaNetwork and Infrastructure Security

A logistics company is hosting a dispatch coordinate management system on Amazon EC2 instances within a Virtual Private Cloud (VPC). A security administrator needs to implement a network security design that meets two criteria:

1. Block a list of specific malicious IP addresses at the subnet boundary before the traffic reaches any resources.
2. Automatically allow return traffic for any authorized inbound connections to the EC2 instances without needing to configure outbound rules.

Which of the following configurations should the administrator implement to meet these requirements? (Select TWO.)

  1. Apply a Network Access Control List (Network ACL) at the subnet level with deny rules to block the malicious IP addresses.Cevap
  2. Apply a Security Group at the instance level to allow inbound traffic, relying on its stateful nature to automatically permit return traffic.Cevap
  3. C
    Apply a Security Group at the instance level with explicit deny rules to block the malicious IP addresses.
  4. D
    Apply a Network Access Control List (Network ACL) at the subnet level to allow inbound traffic, relying on its stateful nature to automatically permit return traffic.
  5. E
    Enable Amazon GuardDuty at the subnet boundary to automatically block traffic from the malicious IP addresses.

Cevap

Apply a Network Access Control List (Network ACL) at the subnet level with deny rules to block the malicious IP addresses, and apply a Security Group at the instance level to allow inbound traffic, relying on its stateful nature to automatically permit return traffic.
The correct strategy combines a subnet-level Network Access Control List (Network ACL) to explicitly block malicious IP addresses (since Network ACLs support deny rules at the subnet boundary) and an instance-level Security Group to control application access (since Security Groups are stateful and automatically permit return traffic for established connections without needing outbound rule configuration).

Adım Adım Çözüm

1
Analyze the requirement to block specific IP addresses at the subnet boundary.
Identify that Network Access Control Lists (NACLs) operate at the subnet level and support explicit deny rules.
Security Groups do not support deny rules and operate at the instance level, so NACLs must be used to block IPs at the subnet boundary.
2
Analyze the requirement to automatically allow return traffic for established connections.
Identify that Security Groups are stateful and automatically track connection states to allow return traffic.
Network ACLs are stateless and require explicit configuration of outbound rules for return traffic, whereas Security Groups automatically handle return traffic.

Anahtar Kavram

Stateful vs. Stateless network firewalls in AWS (Security Groups vs. Network ACLs)
Bu soruyu puanla

Konular

Network and Infrastructure Security

Bu konudan daha fazla soru