Examkin

Soru

Zorluk: OrtaNetwork and Infrastructure Security

A gaming studio deploys a multiplayer matchmaking backend on Amazon EC2 instances inside a public subnet. The studio wants to ensure that only traffic from a specific list of trusted IP addresses can access these instances, and they want to minimize administrative overhead by relying on a stateful resource. Which AWS resource should be configured directly at the instance level to allow inbound traffic from these IP addresses while automatically permitting the corresponding outbound response traffic?

  1. A security groupCevap
  2. B
    A network access control list (network ACL)
  3. C
    Amazon GuardDuty
  4. D
    An AWS-managed firewall configured by AWS under the Shared Responsibility Model

Cevap

A security group
A security group acts as a virtual firewall that controls inbound and outbound traffic for Amazon EC2 instances. It operates at the instance level and is stateful, meaning that any allowed inbound traffic is automatically permitted to flow outbound, satisfying the requirement to minimize administrative overhead by avoiding separate outbound configuration.

Adım Adım Çözüm

1
Identify the level of protection required (instance vs. subnet).
The requirement specifies configuring protection 'directly at the instance level', which points to security groups rather than network ACLs.
Security groups act as a firewall for associated Amazon EC2 instances, whereas network ACLs operate at the subnet boundary.
2
Determine the stateful or stateless nature of the required resource.
The resource must automatically permit outbound response traffic when inbound traffic is allowed (stateful behavior).
Security groups are stateful, meaning any allowed inbound traffic is automatically allowed outbound. Network ACLs are stateless and require explicit rules in both directions.
3
Evaluate the customer responsibility vs. AWS responsibility.
Configuring security controls on EC2 instances is the customer's responsibility under the Shared Responsibility Model.
AWS manages security of the cloud (infrastructure), while the customer manages security in the cloud (operating systems and network access controls).

Anahtar Kavram

Instance-level stateful firewalls in AWS (Security Groups)
Bu soruyu puanla

Konular

Network and Infrastructure Security

Bu konudan daha fazla soru