Soru

Zorluk: OrtaNetwork and Infrastructure Security

A startup is hosting a payment processing application on EC2 instances. To secure the environment, they must satisfy two conditions: block traffic from specific external IP addresses at the subnet boundary, and allow HTTPS traffic to the instances such that return traffic is allowed automatically without explicit outbound rules. Which combination of actions should the startup perform to meet these requirements? (Select TWO.)

  1. Add a deny rule to the subnet's Network Access Control List (NACL) for the specific IP addresses.Cevap
  2. Add an inbound allow rule for port 443 to the Security Group associated with the instances.Cevap
  3. C
    Add both inbound and outbound allow rules for port 443 to the Security Group, as it is stateless and does not track connection state.
  4. D
    Attach the Network Access Control List (NACL) directly to the instances to control host-level inbound and outbound traffic.
  5. E
    Deploy Amazon Inspector to scan incoming packets and block connections from the malicious IP addresses at the subnet level.

Cevap

Add a deny rule to the subnet's Network Access Control List (NACL) for the specific IP addresses, and add an inbound allow rule for port 443 to the Security Group associated with the instances.
The correct actions are to configure a deny rule on the subnet's Network Access Control List (NACL) and an inbound allow rule on the EC2 instances' Security Group. NACLs operate at the subnet boundary and allow explicit deny rules, which meets the requirement of blocking specific malicious IP addresses before they reach the hosts. Security Groups operate at the instance level and are stateful, meaning any permitted inbound connection on port 443 automatically permits the corresponding outbound response traffic without requiring a separate outbound rule.

Adım Adım Çözüm

1
Analyze the requirement to block traffic from specific external IP addresses at the subnet boundary.
Identify that Network Access Control Lists (NACLs) operate at the subnet level and support explicit deny rules, making them suitable for this requirement.
Security Groups do not support explicit deny rules and operate at the instance level, not the subnet level.
2
Analyze the requirement to allow HTTPS traffic to the instances such that return traffic is allowed automatically.
Identify that Security Groups are stateful and operate at the instance level. An inbound rule allowing port 443 automatically permits the return outbound traffic.
NACLs are stateless and require explicit outbound rules to permit return traffic, which violates the requirement for automatic return traffic.

Anahtar Kavram

Understanding the difference between stateful Security Groups (instance-level) and stateless Network ACLs (subnet-level).
Tahmini Süre:1m 30s
Bu soruyu puanla