A healthcare provider is setting up a multi-account AWS environment with twenty Virtual Private Clouds (VPCs) that all need to communicate with a central shared-services VPC. Additionally, the security team requires the ability to block traffic from specific malicious IP addresses at the subnet boundary.
Which of the following AWS network components or configurations should be implemented to meet these requirements? (Select TWO.)
- AWS Transit Gateway to connect the VPCsCevap
- Network Access Control Lists (NACLs) configured at the subnet levelCevap
- CA full mesh of VPC Peering connections between all VPCs
- DSecurity Groups applied to the instances inside the subnets
- EAWS Identity and Access Management (IAM) policies with IP address restriction conditions
Cevap
AWS Transit Gateway and Network Access Control Lists (NACLs) configured at the subnet level
AWS Transit Gateway acts as a centralized cloud router to simplify network connectivity when interconnecting many VPCs. Network Access Control Lists (NACLs) operate at the subnet level and support explicit deny rules, which allows the security team to block malicious IP addresses before they reach the instances.
Adım Adım Çözüm
Anahtar Kavram
AWS Transit Gateway provides simplified multi-VPC routing, while Network Access Control Lists (NACLs) provide stateless subnet-level traffic filtering with explicit deny rules.
Tahmini Süre:1m 30s