A startup is hosting a payment processing application on EC2 instances. To secure the environment, they must satisfy two conditions: block traffic from specific external IP addresses at the subnet boundary, and allow HTTPS traffic to the instances such that return traffic is allowed automatically without explicit outbound rules. Which combination of actions should the startup perform to meet these requirements? (Select TWO.)
- Add a deny rule to the subnet's Network Access Control List (NACL) for the specific IP addresses.Cevap
- Add an inbound allow rule for port 443 to the Security Group associated with the instances.Cevap
- CAdd both inbound and outbound allow rules for port 443 to the Security Group, as it is stateless and does not track connection state.
- DAttach the Network Access Control List (NACL) directly to the instances to control host-level inbound and outbound traffic.
- EDeploy Amazon Inspector to scan incoming packets and block connections from the malicious IP addresses at the subnet level.
Cevap
Add a deny rule to the subnet's Network Access Control List (NACL) for the specific IP addresses, and add an inbound allow rule for port 443 to the Security Group associated with the instances.
The correct actions are to configure a deny rule on the subnet's Network Access Control List (NACL) and an inbound allow rule on the EC2 instances' Security Group. NACLs operate at the subnet boundary and allow explicit deny rules, which meets the requirement of blocking specific malicious IP addresses before they reach the hosts. Security Groups operate at the instance level and are stateful, meaning any permitted inbound connection on port 443 automatically permits the corresponding outbound response traffic without requiring a separate outbound rule.
Adım Adım Çözüm
Anahtar Kavram
Understanding the difference between stateful Security Groups (instance-level) and stateless Network ACLs (subnet-level).
Tahmini Süre:1m 30s