Examkin

Soru

Zorluk: OrtaNetwork and Infrastructure Security

A company is configuring a multi-tier web application within an Amazon VPC and needs to implement granular network security controls. The network architect plans to use a combination of Security Groups and Network Access Control Lists (Network ACLs) to secure the application instances and subnets. Which of the following statements correctly describe how Security Groups and Network ACLs handle inbound and outbound traffic? (Select TWO.)

  1. Security Groups are stateful, meaning allowed inbound traffic is automatically permitted to flow outbound as return traffic.Cevap
  2. Network ACLs are stateless, meaning return traffic for allowed inbound requests must be explicitly permitted by an outbound rule.Cevap
  3. C
    Security Groups are stateless, requiring separate rule configurations for both inbound request traffic and outbound return traffic.
  4. D
    Network ACLs operate at the individual network interface level, while Security Groups operate at the subnet boundary.
  5. E
    Amazon Inspector can be configured as a subnet-level firewall to inspect and filter real-time HTTP traffic.

Cevap

Security Groups are stateful (allowing return traffic automatically) and Network ACLs are stateless (requiring explicit rules for return traffic).
Security Groups are stateful firewalls that operate at the instance level (network interface level). Any allowed inbound traffic automatically permits the corresponding outbound return traffic. In contrast, Network ACLs are stateless firewalls that operate at the subnet level. They do not remember connection states, so outbound return traffic must be explicitly allowed by an outbound rule.

Adım Adım Çözüm

1
Analyze how Security Groups process traffic state.
Security Groups are stateful; once inbound traffic is allowed, the outbound return traffic is automatically allowed.
This is a fundamental design feature of Security Groups to simplify instance-level firewall management.
2
Analyze how Network ACLs process traffic state.
Network ACLs are stateless; they do not track connection state, meaning separate rules are required for inbound and outbound traffic.
This allows subnet-level filtering to have separate controls for ingress and egress traffic.
3
Identify the correct statements and eliminate incorrect options.
The statements defining Security Groups as stateful and Network ACLs as stateless are correct. The statements suggesting the opposite, reversing their operational levels (subnet vs. instance), or misdefining Amazon Inspector are incorrect.
This aligns with the AWS Shared Responsibility Model and core networking concepts in VPC.

Anahtar Kavram

Stateful Security Groups vs. Stateless Network ACLs
Bu soruyu puanla

Konular

Network and Infrastructure Security

Bu konudan daha fazla soru