Examkin

Soru

Zorluk: OrtaNetwork and Infrastructure Security

A financial technology company hosts a transaction processing application on Amazon EC2 instances within a private subnet. The security team must implement a network security strategy that blocks specific malicious IP addresses at the subnet boundary and restricts instance-level access to only authorized application servers. Which of the following configurations should the cloud practitioner implement to meet these requirements? (Select TWO.)

  1. Configure a Network Access Control List (Network ACL) associated with the subnet to explicitly deny inbound traffic from the malicious IP addresses.Cevap
  2. Configure a Security Group associated with the EC2 instances with inbound rules allowing traffic only from the authorized application servers.Cevap
  3. C
    Configure a Security Group associated with the EC2 instances and add inbound deny rules to block the malicious IP addresses.
  4. D
    Configure a Network Access Control List (Network ACL) associated with the subnet with inbound allow rules, and rely on its stateful nature to automatically permit the corresponding outbound response traffic.
  5. E
    Deploy Amazon GuardDuty at the subnet boundary to automatically block traffic from the malicious IP addresses and inspect application-layer packets.

Cevap

The correct configurations are to configure a Network Access Control List (Network ACL) associated with the subnet to explicitly deny inbound traffic from the malicious IP addresses, and configure a Security Group associated with the EC2 instances with inbound rules allowing traffic only from the authorized application servers.
The correct options describe configuring a Network ACL to deny traffic from the malicious IP addresses at the subnet boundary and configuring a Security Group to allow traffic only from authorized application servers. Network ACLs operate at the subnet level and support both allow and deny rules, making them the correct choice for blocking specific IPs. Security Groups operate at the instance level, are stateful, and allow specifying which sources are permitted to access the EC2 instances.

Adım Adım Çözüm

1
Analyze the requirement to block malicious IP addresses at the subnet boundary.
Identify that Network Access Control Lists (Network ACLs) operate at the subnet level and support explicit deny rules, which is suitable for blocking specific IP addresses.
Security Groups operate at the instance level and only support allow rules, so they cannot be used to block specific IPs at the subnet boundary.
2
Analyze the requirement to restrict instance-level access to authorized application servers.
Identify that Security Groups operate at the instance level and can be configured with inbound rules to allow traffic from specific sources, such as the authorized application servers.
Security Groups are stateful firewalls that filter traffic at the instance level, making them ideal for restricting access to specific instances.

Anahtar Kavram

Understanding the differences between Security Groups (stateful, instance-level, allow rules only) and Network ACLs (stateless, subnet-level, allow and deny rules).
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Network and Infrastructure Security

Bu konudan daha fazla soru