Examkin

Soru

Zorluk: ZorAWS Network Services

A company is reviewing the security posture of a database instance hosted within a private subnet of an Amazon Virtual Private Cloud (Amazon VPC). The database must only accept incoming queries from a specific application server located in a public subnet. To enforce defense-in-depth, the network security team wants to implement access controls at both the individual resource level and the boundary of the subnet. Which configuration of AWS network security features meets these requirements?

  1. A stateful Security Group associated with the database instance to allow inbound traffic from the application server, and a stateless Network ACL associated with the private subnet to control traffic entering and leaving the subnet boundary.Cevap
  2. B
    A stateless Security Group associated with the database instance to allow inbound traffic from the application server, and a stateful Network ACL associated with the private subnet to control traffic entering and leaving the subnet boundary.
  3. C
    A stateful Security Group associated with the private subnet to allow inbound traffic from the application server, and a stateless Network ACL associated with the database instance to control traffic at the resource level.
  4. D
    A VPC Peering connection established between the public and private subnets to isolate the network path, and a stateful Security Group associated with the database instance.

Cevap

A stateful Security Group associated with the database instance to allow inbound traffic from the application server, and a stateless Network ACL associated with the private subnet to control traffic entering and leaving the subnet boundary.
The correct configuration applies a stateful Security Group to the database instance to control traffic at the resource level, and a stateless Network ACL to the private subnet to control traffic at the subnet boundary. Security Groups automatically allow return traffic for approved requests, whereas Network ACLs require explicit inbound and outbound rules.

Adım Adım Çözüm

1
Identify the target resource-level security requirement.
Determine that Security Groups apply at the instance/elastic network interface level and are stateful.
Security Groups allow granular control over instance-level inbound and outbound traffic.
2
Identify the target subnet-level security requirement.
Determine that Network ACLs apply at the subnet boundary and are stateless.
Network ACLs act as a firewall for controlling traffic in and out of one or more subnets.
3
Combine the configurations to meet the security objectives.
Associate the stateful Security Group with the database instance and the stateless Network ACL with the private subnet.
This combination ensures defense-in-depth by filtering traffic at both the subnet boundary and the individual resource level.

Anahtar Kavram

VPC Network Security: Security Groups vs Network ACLs
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

AWS Network Services

Bu konudan daha fazla soru