A company is hosting a web application on Amazon EC2 instances within a public VPC subnet. The system administrator wants to protect the web tier by implementing two security controls: block all traffic from a known malicious range of IP addresses, and restrict access to the web instances to only HTTP and HTTPS traffic. Which two of the following configurations should the administrator implement to meet these requirements?
- Create a Network Access Control List (NACL) associated with the subnet and add an inbound deny rule for the malicious IP address range.Cevap
- Create a Security Group associated with the EC2 instances and add inbound allow rules for HTTP and HTTPS traffic.Cevap
- CCreate a Security Group associated with the EC2 instances and add an inbound deny rule for the malicious IP address range.
- DConfigure Amazon Inspector to monitor the subnet and automatically block network traffic from the malicious IP address range.
- EOpen a support case requesting AWS to block the malicious IP addresses at the physical data center border under the customer's shared responsibility guidelines.
Cevap
Creating a Network Access Control List (NACL) with an inbound deny rule for the malicious IP range, and creating a Security Group with inbound allow rules for HTTP and HTTPS traffic.
The correct configuration uses a Network Access Control List (NACL) to deny traffic from the malicious IP range because NACLs operate at the subnet level and support explicit deny rules. It also uses a Security Group to allow only HTTP and HTTPS traffic because Security Groups act at the instance level as stateful firewalls controlling inbound allowed ports.
Adım Adım Çözüm
Anahtar Kavram
Understanding the difference between stateful Security Groups (operating at the instance level with allow rules only) and stateless Network ACLs (operating at the subnet level with allow/deny rules).
Tahmini Süre:1m 30s