Examkin

Soru

Zorluk: OrtaNetwork and Infrastructure Security

A logistics firm runs a vehicle tracking application on Amazon EC2 instances within a specific subnet in a Virtual Private Cloud (VPC). The security team must implement a solution that allows incoming HTTPS traffic to the EC2 instances from a trusted corporate partner's IP address range. Additionally, they must block all inbound traffic from a known malicious IP range at the subnet boundary. Which combination of AWS network security actions will meet these requirements? (Select TWO.)

  1. Create an inbound rule in the Security Group associated with the EC2 instances to allow HTTPS traffic from the partner's IP address rangeCevap
  2. Create an inbound deny rule in the Network Access Control List (Network ACL) associated with the subnet to block the malicious IP rangeCevap
  3. C
    Create an inbound deny rule in the Security Group associated with the EC2 instances to block the malicious IP range
  4. D
    Configure Amazon GuardDuty to block traffic from the malicious IP range before it reaches the Virtual Private Cloud (VPC)
  5. E
    Deploy Amazon Inspector to monitor network routing tables and drop packets originating from the malicious IP range

Cevap

The correct actions are to create an inbound allow rule in a Security Group for the trusted partner's IP range, and to create an inbound deny rule in a Network ACL for the malicious IP range.
To allow traffic to specific EC2 instances, you configure an inbound allow rule in a Security Group, which operates at the instance level. To block a malicious IP range at the subnet boundary, you configure an inbound deny rule in a Network ACL, which operates at the subnet level and supports explicit deny rules.

Adım Adım Çözüm

1
Analyze the requirement to allow inbound traffic from a trusted partner's IP range at the EC2 instance level.
Identify that Security Groups are the primary tool for instance-level firewall protection and support allow rules.
Security Groups control inbound and outbound traffic at the instance interface level.
2
Analyze the requirement to block a known malicious IP range at the subnet boundary.
Identify that Network Access Control Lists (Network ACLs) operate at the subnet level and support explicit deny rules.
Network ACLs act as a stateless firewall to filter traffic before it enters or leaves the subnet boundary, and support explicit deny rules.

Anahtar Kavram

The difference between instance-level stateful Security Groups and subnet-level stateless Network ACLs in AWS VPC architecture.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Network and Infrastructure Security

Bu konudan daha fazla soru