Examkin

Security and Compliance

441 soru

Tüm türler441Çoktan seçmeli225Çoklu seçim216
Soru 421Soru →

A university IT department is setting up its AWS environment. The administrator needs to configure permissions for two scenarios: first, allowing an Amazon EC2 instance to securely write logs to an Amazon CloudWatch Logs stream; second, organizing access for ten lab students who all require identical read-only permissions to Amazon S3. Which of the following IAM solutions represent AWS best practices for these scenarios? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM role to the Amazon EC2 instance to grant the required CloudWatch Logs write permissions.; Place the ten lab student IAM users into an IAM group and attach a managed S3 read-only policy to that group.

Cevap

Attaching an IAM role to the EC2 instance for CloudWatch permissions, and placing the lab students into an IAM group with a managed S3 read-only policy attached to the group.
The correct options recommend attaching an IAM role to the EC2 instance and placing the lab students into an IAM group. Using IAM roles for EC2 instances allows them to securely access other AWS services using temporary credentials without storing permanent credentials. Placing users with identical access requirements into an IAM group allows permissions to be managed collectively, adhering to operational efficiency.

Adım Adım Çözüm

1
Analyze the EC2 logging scenario to determine the secure way to grant permissions to AWS resources.
Identify that applications running on EC2 instances require temporary security credentials, which are securely provided using IAM roles rather than permanent access keys.
This aligns with the best practice of avoiding hardcoded long-term credentials.
2
Analyze the student access scenario to identify the most efficient way to manage identical permissions for multiple users.
Determine that placing the users in an IAM group and attaching the S3 read-only policy to the group is the recommended operational practice.
This simplifies permission management and ensures consistency across all identical users.

Anahtar Kavram

AWS IAM Best Practices for Access Management (Roles and Groups)
Soru 422Soru →

An online travel agency is migrating its booking application to AWS. The agency must ensure that customer passport numbers are encrypted at rest using encryption keys managed by the customer, and that database backups are securely stored. Under the AWS shared responsibility model, which of the following are responsibilities of the customer for protecting this data? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Defining key policies and rotation schedules for Customer Managed Keys (CMKs) in AWS Key Management Service (AWS KMS); Enabling server-side encryption on the storage services used for storing database backups

Cevap

The customer is responsible for defining key policies and rotation schedules for Customer Managed Keys (CMKs) in AWS KMS, and enabling server-side encryption on the storage services used for storing database backups.
Under the AWS shared responsibility model, the customer is responsible for security 'in' the cloud, which includes configuring data encryption at rest (such as enabling server-side encryption on backup storage) and managing key access policies and rotation schedules for Customer Managed Keys (CMKs) within AWS Key Management Service (AWS KMS).

Adım Adım Çözüm

1
Differentiate between customer responsibilities (security 'in' the cloud) and AWS responsibilities (security 'of' the cloud) regarding data protection.
Identify that managing key configurations and enabling encryption settings on storage services are customer duties, whereas physical security and hardware retirement are AWS duties.
To classify each option according to the AWS Shared Responsibility Model.
2
Evaluate the management boundaries of AWS KMS key types and AWS CloudHSM.
Determine that standard AWS-managed keys cannot be managed within a dedicated AWS CloudHSM cluster, which is a single-tenant hardware solution.
To eliminate incorrect options regarding key management infrastructure integrations.

Anahtar Kavram

AWS Shared Responsibility Model for Data Encryption and Key Management
Soru 423Soru →

A company hosts a payroll processing portal on Amazon EC2 instances inside a virtual private cloud (VPC). The security administrator needs to permit inbound HTTPS traffic on port 443 from a specific corporate office IP address range. The administrator wants the return traffic from the EC2 instances back to the corporate office to be permitted automatically without needing to define any outbound rules. Which AWS resource or feature should the administrator configure to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Security groups associated with the EC2 instances

Cevap

Security groups associated with the EC2 instances
The correct answer is the option focusing on security groups associated with the EC2 instances. Security groups are stateful firewalls that operate at the instance level. Because they are stateful, any permitted inbound traffic automatically allows the return response traffic to flow back, eliminating the need to write a corresponding outbound rule.

Adım Adım Çözüm

1
Analyze the requirement for automatic return traffic permission without explicit outbound rules.
Determined that the firewall mechanism must be stateful.
Stateful firewalls automatically allow response traffic for any established inbound connection.
2
Evaluate the stateful and stateless properties of AWS network security features.
Identified that Security Groups are stateful and operate at the instance level, whereas Network ACLs are stateless and operate at the subnet level.
This determines which configuration meets the automatic return traffic requirement.
3
Select the appropriate resource based on responsibility and firewall characteristics.
Security groups associated with the EC2 instances is the correct resource, as configuration of instance firewalls falls under the customer's responsibility.
Security groups satisfy both the technical stateful requirement and the shared responsibility model rules.

Anahtar Kavram

Security groups are stateful firewalls that control inbound and outbound traffic for Amazon EC2 instances, automatically allowing return traffic for any permitted inbound connection.
Soru 424Soru →

A logistics firm runs a vehicle tracking application on Amazon EC2 instances within a specific subnet in a Virtual Private Cloud (VPC). The security team must implement a solution that allows incoming HTTPS traffic to the EC2 instances from a trusted corporate partner's IP address range. Additionally, they must block all inbound traffic from a known malicious IP range at the subnet boundary. Which combination of AWS network security actions will meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an inbound rule in the Security Group associated with the EC2 instances to allow HTTPS traffic from the partner's IP address range; Create an inbound deny rule in the Network Access Control List (Network ACL) associated with the subnet to block the malicious IP range

Cevap

The correct actions are to create an inbound allow rule in a Security Group for the trusted partner's IP range, and to create an inbound deny rule in a Network ACL for the malicious IP range.
To allow traffic to specific EC2 instances, you configure an inbound allow rule in a Security Group, which operates at the instance level. To block a malicious IP range at the subnet boundary, you configure an inbound deny rule in a Network ACL, which operates at the subnet level and supports explicit deny rules.

Adım Adım Çözüm

1
Analyze the requirement to allow inbound traffic from a trusted partner's IP range at the EC2 instance level.
Identify that Security Groups are the primary tool for instance-level firewall protection and support allow rules.
Security Groups control inbound and outbound traffic at the instance interface level.
2
Analyze the requirement to block a known malicious IP range at the subnet boundary.
Identify that Network Access Control Lists (Network ACLs) operate at the subnet level and support explicit deny rules.
Network ACLs act as a stateless firewall to filter traffic before it enters or leaves the subnet boundary, and support explicit deny rules.

Anahtar Kavram

The difference between instance-level stateful Security Groups and subnet-level stateless Network ACLs in AWS VPC architecture.
Tahmini Süre:1m 30s
Soru 425Soru →

A digital publishing company is storing sensitive author manuscripts in an Amazon S3 bucket. The company mandates the use of server-side encryption with AWS Key Management Service (SSE-KMS) to protect the data at rest. Under the AWS Shared Responsibility Model, which of the following security-related tasks is the responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Defining and managing the key policies that control access to the encryption keys

Cevap

Defining and managing the key policies that control access to the encryption keys
The correct answer is correct because configuring key policies determines who can access the keys, which is a customer-side configuration control under the Shared Responsibility Model.

Adım Adım Çözüm

1
Analyze the encryption requirement in the scenario.
The scenario requires using server-side encryption with AWS KMS (SSE-KMS) on Amazon S3.
This establishes that the service in use is AWS Key Management Service (KMS), which is an AWS-managed service.
2
Apply the Shared Responsibility Model boundaries to the KMS service.
AWS is responsible for physical security, hardware maintenance, and patching the host OS. The customer is responsible for configuring access policies, key rotation, and usage permissions.
This helps isolate customer duties from AWS duties.
3
Evaluate the choices to identify the task managed by the customer.
Defining key policies is a customer configuration task, whereas physical security, OS patching, and dedicated HSM provisioning do not apply to the customer's KMS configuration.
This yields the correct answer and identifies why other choices represent AWS responsibilities or incorrect service mappings.

Anahtar Kavram

The AWS Shared Responsibility Model specifies that for managed services like AWS KMS, AWS manages the underlying infrastructure and physical security, while the customer manages access policies and key configurations.
Tahmini Süre:1m 15s
Soru 426Soru →

A fintech startup is deploying a transaction processing application on AWS. They need to configure access control for two distinct scenarios: first, an application running on an Amazon EC2 instance that needs to read and write transactions to an Amazon DynamoDB table; second, a cloud engineer who requires access to the AWS Management Console to monitor resources. Which of the following identity and access management practices should the startup implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an IAM role with the minimum permissions required to access the DynamoDB table and attach it to the EC2 instance profile.; Create a dedicated IAM user for the cloud engineer, assign permissions using an IAM group, and enable multi-factor authentication (MFA).

Cevap

The startup should configure an IAM role with the minimum permissions for DynamoDB access and attach it to the EC2 instance profile, and also create a dedicated IAM user for the cloud engineer, assigning permissions through an IAM group with multi-factor authentication (MFA) enabled.
The correct configurations involve using an IAM role for the EC2 instance to safely access the DynamoDB table via temporary credentials, and creating a dedicated IAM user with MFA and group-based permissions for the cloud engineer. These steps adhere to the AWS best practices of avoiding root user usage for daily operations and utilizing temporary credentials where possible.

Adım Adım Çözüm

1
Identify the access requirements for the EC2 instance application.
The application needs access to a DynamoDB table. Instead of using long-term credentials like an IAM user's access keys, the secure approach is to use temporary credentials.
Attaching an IAM role to the EC2 instance profile provides the application with temporary, automatically rotated credentials, eliminating the risk of exposed secrets.
2
Identify the access requirements for the cloud engineer.
The engineer needs to access the console. The best practice is to create a dedicated IAM user with permissions managed via a group and protect the account with multi-factor authentication (MFA).
Using the root user for daily activities is highly discouraged, and group-based permissions simplify access management while MFA adds an extra layer of security.

Anahtar Kavram

AWS Identity and Access Management (IAM) best practices for applications and administrators
Soru 427Soru →

A research institution runs high-performance scientific simulations on Amazon EC2 instances within a private subnet. The security team must implement a network security strategy that meets two requirements:

1. Block traffic from a specific range of external IP addresses at the subnet boundary by explicitly evaluating both inbound and outbound traffic.
2. Allow incoming simulation control data to the EC2 instances, ensuring that return traffic is automatically permitted without requiring explicit outbound rules.

Which combination of AWS features best satisfies these requirements?

Cevabı ve açıklamayı göster

Cevap: Network Access Control Lists (NACLs) at the subnet level to block the IP range, and Security Groups at the instance level to allow the control data

Cevap

Network Access Control Lists (NACLs) at the subnet level to block the IP range, and Security Groups at the instance level to allow the control data
The correct answer correctly identifies that Network Access Control Lists (NACLs) operate at the subnet level and are stateless, meaning both inbound and outbound traffic must be explicitly allowed or denied. This makes NACLs ideal for blocking specific IP ranges at the subnet boundary. Security Groups operate at the instance level and are stateful, meaning any allowed inbound traffic automatically permits the corresponding outbound response traffic, satisfying the second requirement.

Adım Adım Çözüm

1
Evaluate the first requirement: blocking a specific IP range at the subnet boundary with explicit inbound and outbound evaluation.
This requires a subnet-level firewall that is stateless, meaning outbound traffic must be explicitly evaluated alongside inbound traffic. Network Access Control Lists (NACLs) operate at the subnet level and are stateless.
Stateless firewalls do not track connection states, so both directions of traffic must have explicit rules.
2
Evaluate the second requirement: allowing simulation traffic at the instance level with automatic return traffic permission.
This requires an instance-level firewall that is stateful, meaning response traffic is automatically allowed if the request is permitted. Security Groups operate at the instance level and are stateful.
Stateful firewalls track the state of connections and automatically permit response traffic without needing explicit outbound rules.
3
Combine both components to select the option that uses NACLs at the subnet level and Security Groups at the instance level.
The correct combination uses NACLs for the subnet-level blocklist and Security Groups for instance-level simulation data filtering.
This architecture correctly utilizes the distinct properties of stateful and stateless firewalls at their respective boundaries.

Anahtar Kavram

Stateful vs. Stateless network firewalls in a VPC (Security Groups vs. Network ACLs)
Soru 428Soru →

A real estate platform is migrating its property transaction registry to AWS. The platform must encrypt all sensitive transaction records at rest using AWS Key Management Service (AWS KMS). Under the AWS Shared Responsibility Model, which of the following actions are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring key policies to control which IAM users and roles have permissions to use the KMS keys; Selecting which specific datasets, files, or database tables are selected for encryption

Cevap

Under the AWS Shared Responsibility Model, the customer is responsible for configuring access permissions (key policies) to control usage of the encryption keys and selecting which specific resources (such as files, folders, or database tables) are encrypted. AWS is responsible for physical security of the data centers and the underlying multi-tenant infrastructure.
Configuring access permissions (key policies) and choosing which data components to encrypt are customer responsibilities because they belong to security 'in' the cloud. The customer maintains full ownership over data classification and key authorization rules.

Adım Adım Çözüm

1
Analyze the service model of AWS KMS.
AWS KMS is a managed service where AWS manages the underlying hardware security modules (HSMs) and the multi-tenant virtualization layer, while the customer controls key usage and configuration.
This helps separate customer configuration tasks from AWS infrastructure management tasks.
2
Differentiate between customer responsibilities (security 'in' the cloud) and AWS responsibilities (security 'of' the cloud).
Customer tasks include configuring key policies and choosing what data to encrypt. AWS tasks include physical data center security, hardware maintenance, and media disposal.
Applying the Shared Responsibility Model allows identification of correct actions belonging to each party.

Anahtar Kavram

Under the AWS Shared Responsibility Model, the customer is responsible for data classification, choosing what to encrypt, and configuring key policies to manage access. AWS handles the physical security of the facilities, media sanitization, and underlying multi-tenant HSM infrastructure.
Tahmini Süre:1m 30s
Soru 429Soru →

An eco-tourism agency hosts its public-facing room booking portal on Amazon EC2 instances within a public subnet, and its internal database on EC2 instances within a private subnet. The security team needs to configure network security controls to meet two requirements: block specific malicious public IP addresses at the subnet boundary, and allow the web servers to communicate with the database while ensuring return traffic is automatically allowed at the instance level. Which TWO configurations should the security team implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an inbound deny rule in the Network ACL associated with the web server subnet to block the malicious IP addresses.; Configure the database security group to allow inbound traffic from the web servers, relying on the stateful nature of security groups to permit return traffic.

Cevap

The security team should create an inbound deny rule in the Network ACL associated with the web server subnet, and configure the database security group to allow inbound traffic from the web servers.
The requirements are met by combining a Network ACL and a Security Group. A Network ACL operates at the subnet boundary and supports explicit deny rules, which allows the security team to block specific malicious IP addresses. A security group operates at the instance level and is stateful, meaning that allowing inbound traffic automatically permits the corresponding outbound return traffic without requiring separate outbound configuration.

Adım Adım Çözüm

1
Identify the service required to block specific IP addresses at the subnet level.
Network Access Control Lists (NACLs) operate at the subnet boundary and support explicit deny rules, allowing the blocking of specific malicious IP addresses.
Security groups do not support deny rules and operate at the instance level, not the subnet boundary.
2
Identify the configuration required to allow instance-to-instance communication with automatic return traffic.
Security groups are stateful firewalls at the instance level; allowing inbound traffic automatically permits the corresponding return traffic.
Using a stateful security group eliminates the need to configure outbound rules for return traffic, whereas a stateless Network ACL would require explicit configuration in both directions.

Anahtar Kavram

Security groups are stateful firewalls at the instance level that support only allow rules, whereas Network ACLs are stateless firewalls at the subnet level that support both allow and deny rules.
Soru 430Soru →

A logistics company is deploying a global package tracking system on AWS. The security team mandates that all telemetry data must be encrypted in transit from the tracking devices to the application's Application Load Balancer. Under the AWS Shared Responsibility Model, which of the following actions is the responsibility of the customer to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Configuring the Application Load Balancer with an HTTPS listener and associating a valid SSL/TLS certificate

Cevap

Configuring the Application Load Balancer with an HTTPS listener and associating a valid SSL/TLS certificate
Under the AWS Shared Responsibility Model, AWS secures the physical infrastructure and hypervisor layers, while the customer is responsible for configuring security settings for their deployed resources. For encrypting data in transit to an Application Load Balancer, the customer must configure an HTTPS listener and associate it with an SSL/TLS certificate (which can be provisioned via AWS Certificate Manager).

Adım Adım Çözüm

1
Identify the boundary of responsibility for data protection in transit under the AWS Shared Responsibility Model.
The customer is responsible for configuring encryption of data in transit for their applications (such as setting up HTTPS), while AWS is responsible for securing the underlying physical infrastructure and networks.
This establishes which layer of the security configuration the customer must perform.
2
Evaluate the standard mechanism for securing connections to an Application Load Balancer.
The customer must create an HTTPS listener on the load balancer and configure it with an SSL/TLS certificate.
This configuration enables SSL/TLS termination at the load balancer, ensuring transit encryption from the client.

Anahtar Kavram

AWS Shared Responsibility Model for Data in Transit Encryption
Tahmini Süre:1m 30s
Soru 431Soru →

A software development company wants to allow its developers to access the AWS Management Console using their existing corporate Active Directory credentials. The security team needs to configure this access without creating individual IAM users for each developer. Which of the following approaches represents the AWS-recommended best practice to achieve this?

Cevabı ve açıklamayı göster

Cevap: Configure identity federation using AWS IAM Identity Center to map corporate Active Directory groups to IAM roles.

Cevap

Configuring identity federation using AWS IAM Identity Center to map corporate Active Directory groups to IAM roles is the correct approach.
Configuring identity federation using AWS IAM Identity Center allows the organization to leverage its existing corporate identity provider. By mapping Active Directory groups to IAM roles, developers can sign in with their corporate credentials and assume temporary security credentials, eliminating the need to create and maintain individual IAM users in AWS.

Adım Adım Çözüm

1
Identify the requirement of using existing corporate credentials for AWS console access without creating local IAM users.
This points to a need for identity federation rather than standard IAM user creation.
Federation delegates authentication to an external identity provider.
2
Determine the appropriate AWS service for integration.
AWS IAM Identity Center is the recommended service for managing single sign-on access to AWS accounts and applications.
It simplifies multi-account access and integrates with external identity sources like Active Directory.
3
Map the corporate identities to AWS permissions.
Active Directory groups are mapped to specific IAM roles that define the permissions developers will assume upon login.
IAM roles provide temporary credentials, ensuring secure and automated access control.

Anahtar Kavram

Identity Federation and Role-Based Access Control
Soru 432Soru →

A financial services firm is deploying a web application on Amazon EC2 instances in a new Virtual Private Cloud (VPC). The network security team wants to configure a firewall control that operates at the instance level. They require that any inbound traffic allowed into the instance is automatically permitted to flow outbound, without needing to create a corresponding outbound rule. Which AWS resource meets these requirements?

Cevabı ve açıklamayı göster

Cevap: A security group, because it is stateful and evaluates traffic at the instance level.

Cevap

A security group, because it is stateful and evaluates traffic at the instance level.
The correct answer states that a security group is stateful and operates at the instance level. In AWS, security groups act as virtual firewalls for EC2 instances. Because they are stateful, connection tracking automatically permits response traffic to flow back to the client even if no outbound rules allow it.

Adım Adım Çözüm

1
Determine the required evaluation boundary (subnet vs. instance).
The requirement specifies instance-level control, which aligns with Security Groups rather than Network ACLs (which operate at the subnet level).
Identifying the correct layer of defense helps narrow down the appropriate AWS security service.
2
Identify the statefulness requirements for return traffic.
The requirement demands that return traffic is automatically allowed without explicit rules. This is the definition of stateful connection tracking, which is supported by Security Groups.
Stateless controls like Network ACLs evaluate inbound and outbound traffic independently, requiring manual rules for both directions.

Anahtar Kavram

AWS Security Groups are stateful firewalls that operate at the instance level, whereas Network ACLs are stateless firewalls that operate at the subnet level.
Soru 433Soru →

A healthcare provider plans to build a patient portal on AWS. The portal will run on Amazon EC2 instances and store sensitive medical imaging files in an Amazon S3 bucket. Compliance regulations require all data to be encrypted both at rest and in transit.

Which of the following actions are the responsibility of the customer to ensure data protection under the AWS Shared Responsibility Model? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enabling SSL/TLS (HTTPS) for data transmission between the EC2 instances and the S3 bucket to protect data in transit; Defining key policies for AWS Key Management Service (AWS KMS) customer managed keys to control access for encryption at rest

Cevap

Enabling SSL/TLS (HTTPS) for data transmission between the EC2 instances and the S3 bucket to protect data in transit, and defining key policies for AWS Key Management Service (AWS KMS) customer managed keys to control access for encryption at rest
The correct actions are configuring SSL/TLS (HTTPS) for data in transit and defining key policies for AWS KMS customer managed keys. Under the AWS Shared Responsibility Model, the customer is responsible for 'security in the cloud,' which includes encrypting their own data in transit (by using HTTPS protocols) and managing access control to their encryption keys (via key policies).

Adım Adım Çözüm

1
Identify the data protection requirements in the scenario.
The compliance regulations require encryption at rest and encryption in transit for patient data.
This establishes the scope of the required security controls.
2
Apply the AWS Shared Responsibility Model to differentiate customer and AWS duties for encryption.
The customer is responsible for configuring SSL/TLS (HTTPS) for data in transit and managing key policies for AWS KMS keys at rest. AWS is responsible for physical hardware security and underlying infrastructure maintenance.
This isolates the tasks that fall under customer ownership from those managed automatically by AWS.

Anahtar Kavram

Under the AWS Shared Responsibility Model, AWS manages security 'of' the cloud (including physical security, hypervisors, and managed service infrastructure), while the customer manages security 'in' the cloud (including configuring secure transport protocols, managing encryption keys, and defining key policies).
Soru 434Soru →

A growing digital marketing agency wants to streamline permissions management for its designers, copywriters, and analysts. The agency needs to ensure that when a new designer joins, they automatically receive the correct permissions, and when they change roles, their permissions are updated easily. Which of the following options represent AWS-recommended best practices to achieve this? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Organize IAM users into IAM groups based on job functions and attach policies to the groups.; Apply the principle of least privilege by granting only the permissions required for each job function.

Cevap

Organizing IAM users into groups based on job functions and applying the principle of least privilege by granting only the necessary permissions.
Organizing users into IAM groups based on job functions simplifies the management of permissions because policies can be attached to the group rather than individual users. Moving a user between groups automatically updates their permissions. Additionally, applying the principle of least privilege ensures that users have only the minimum access necessary, which improves security.

Adım Adım Çözüm

1
Analyze the requirements for streamlining access control and permissions updates for different job functions.
Identify that managing permissions individually is inefficient and that groups are the AWS-recommended way to manage permissions for multiple users with similar job functions.
Grouping simplifies policy attachment and ensures consistency.
2
Evaluate the security principles for granting access to resources.
Apply the principle of least privilege, ensuring that users have only the permissions required for their specific role.
This reduces the blast radius of compromised credentials.

Anahtar Kavram

AWS IAM Groups and the Principle of Least Privilege
Soru 435Soru →

A health-tech startup hosts its patient record database on Amazon EC2 instances inside a private subnet of a Virtual Private Cloud (VPC). The security team needs to restrict incoming database traffic to only the application server instances. Additionally, any outbound response traffic from the database back to the application servers must be allowed automatically, without configuring an explicit outbound rule. Which AWS firewall option should the security team configure to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Security Groups at the instance level, because they are stateful and automatically allow outbound responses to allowed inbound requests.

Cevap

Security Groups at the instance level, because they are stateful and automatically allow outbound responses to allowed inbound requests.
The correct option is the one specifying Security Groups at the instance level. Security Groups are stateful, meaning any inbound traffic allowed is automatically permitted to flow outbound as a response, meeting the requirement to allow return traffic without an explicit outbound rule. They also operate at the instance level, allowing granular access control between specific application and database instances.

Adım Adım Çözüm

1
Analyze the requirement for instance-level traffic restriction to the application server instances.
Identify that the firewall must support instance-level targeting (such as referencing the application server security group).
This isolates the database instances from other resources within the same or different subnets.
2
Evaluate the statefulness requirement: return traffic must be allowed automatically without explicit outbound rules.
Security Groups are stateful and track connection states, allowing return traffic automatically. Network ACLs are stateless and would require explicit outbound rule configurations.
Choosing a stateful resource satisfies the requirement to allow return traffic automatically without additional outbound rules.

Anahtar Kavram

Stateful instance-level security (Security Groups) vs. stateless subnet-level security (Network ACLs)
Soru 436Soru →

An organization is designing the network security architecture for a multi-tier application in an Amazon VPC. The database tier resides in a private subnet, while the web tier is in a public subnet. The security team needs to implement controls to restrict inbound and outbound traffic at both the subnet boundary and the individual Amazon EC2 instance level. Which of the following statements correctly describe the characteristics of Security Groups and Network Access Control Lists (Network ACLs) in this architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security Groups are stateful, meaning if an inbound rule allows traffic to reach a database instance, the outbound response is permitted automatically.; Network ACLs are stateless, meaning if an inbound rule allows traffic into a subnet, a corresponding outbound rule must be configured to allow the return traffic.

Cevap

Security Groups are stateful, so inbound rules automatically permit outbound response traffic, while Network ACLs are stateless, requiring explicit inbound and outbound rules to allow return traffic.
Security Groups are stateful, meaning outbound response traffic is permitted automatically if inbound traffic is allowed. In contrast, Network ACLs are stateless, requiring explicit configuration of both inbound and outbound rules to allow return traffic.

Adım Adım Çözüm

1
Analyze the operational scope of Security Groups and Network ACLs in an Amazon VPC configuration.
Security Groups operate at the instance level (Elastic Network Interface), while Network ACLs operate at the subnet level.
This establishes where each security control is applied within the VPC architecture.
2
Determine the stateful nature of both security controls to evaluate how return traffic is handled.
Security Groups are stateful (automatically allowing return traffic), while Network ACLs are stateless (requiring return rules).
This shows how traffic rules must be configured in both directions for each control.

Anahtar Kavram

Stateful Security Groups vs. Stateless Network ACLs
Tahmini Süre:1m 30s
Soru 437Soru →

A media company is hosting a public-facing live video streaming ingest service on Amazon EC2 instances. The administrator needs to permit incoming traffic on port 1935 (RTMP) and ensure that outbound response traffic is automatically permitted back to the client without configuring any outbound rules. Which AWS security resource should be configured to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Security groups

Cevap

Security groups
Security groups are stateful firewalls that operate at the instance level. When an inbound rule is created to allow traffic, the return outbound traffic is automatically allowed, making it the correct choice for this scenario.

Adım Adım Çözüm

1
Analyze the traffic requirement
The requirement is to allow inbound traffic on a specific port (1935) and automatically allow the return/outbound traffic without manually writing outbound rules.
This behavior indicates a stateful firewall resource that operates at the instance level.
2
Evaluate the stateful vs. stateless nature of AWS firewalls
Security groups are stateful and automatically permit return traffic, while Network ACLs are stateless and require explicit return rules.
Choosing security groups satisfies the requirement of automatically permitting outbound response traffic.

Anahtar Kavram

Stateful filtering with Security Groups
Tahmini Süre:1m 0s
Soru 438Soru →

A company is configuring network security for a web application hosted on Amazon EC2 instances in a VPC. The security team has two requirements:

1. Apply rules at the subnet boundary where both inbound and outbound traffic must be explicitly allowed, as rules are evaluated independently for return traffic.
2. Apply rules at the instance boundary where allowing inbound traffic automatically permits the corresponding outbound return traffic.

Which combination of AWS security features should the company use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Network Access Control Lists (NACLs) at the subnet level because they are stateless, and Security Groups at the instance level because they are stateful

Cevap

Network Access Control Lists (NACLs) at the subnet level because they are stateless, and Security Groups at the instance level because they are stateful
The correct answer combines Network Access Control Lists (NACLs) for the subnet-level requirement and Security Groups for the instance-level requirement. NACLs are stateless firewalls that control inbound and outbound traffic at the subnet boundary, meaning outbound return traffic must be explicitly permitted. Security Groups are stateful firewalls that apply to individual EC2 instances, meaning once inbound traffic is allowed, the outbound return traffic is automatically allowed.

Adım Adım Çözüm

1
Analyze the subnet-level requirement.
The requirement states that rules must be evaluated independently for return traffic, meaning the firewall is stateless. Network Access Control Lists (NACLs) operate at the subnet boundary and are stateless.
Stateless firewalls do not keep track of connection state, so outbound return traffic must be explicitly allowed by an outbound rule.
2
Analyze the instance-level requirement.
The requirement states that allowing inbound traffic should automatically permit the corresponding outbound return traffic, meaning the firewall is stateful. Security Groups operate at the instance boundary and are stateful.
Stateful firewalls track connection state, allowing return traffic automatically without requiring an explicit outbound rule.

Anahtar Kavram

The difference between stateful Security Groups (operating at the instance level) and stateless Network Access Control Lists (operating at the subnet level).
Tahmini Süre:1m 30s
Soru 439Soru →

A gaming company is deploying matchmaking servers on Amazon EC2 instances within a Virtual Private Cloud (VPC). The network security architecture must meet the following requirements:
1. Control traffic at the individual instance level, ensuring that return traffic for allowed inbound requests is automatically permitted.
2. Control traffic at the subnet boundary, acting as a secondary layer of defense that requires explicit rules for both inbound and outbound traffic.

Which two AWS network security features should the company implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security Groups; Network Access Control Lists (NACLs)

Cevap

Security Groups and Network Access Control Lists (NACLs)
The correct choices are Security Groups and Network Access Control Lists (NACLs). Security Groups act as a firewall for EC2 instances and are stateful, meaning any allowed inbound traffic automatically permits the corresponding outbound return traffic. Network Access Control Lists (NACLs) act as a firewall at the subnet boundary and are stateless, meaning return traffic must be explicitly allowed by configuring both inbound and outbound rules.

Adım Adım Çözüm

1
Identify the requirement for instance-level, stateful traffic control.
Security Groups are identified as the service that operates at the instance level and automatically permits return traffic due to their stateful nature.
This fulfills the first requirement of the scenario.
2
Identify the requirement for subnet-level, stateless traffic control.
Network Access Control Lists (NACLs) are identified as the service that operates at the subnet boundary and requires explicit rules for both inbound and outbound traffic because they are stateless.
This fulfills the second requirement of the scenario.

Anahtar Kavram

Understanding the differences between Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level) in AWS VPC security.
Tahmini Süre:1m 30s
Soru 440Soru →

An online education platform hosts its virtual classroom application on Amazon EC2 instances within a public subnet of a VPC. To enhance security, the network administrator must meet two requirements:
1. Block all inbound traffic from a known list of malicious IP addresses before it reaches the subnet.
2. Ensure the EC2 instances accept inbound HTTPS traffic on port 443, while automatically allowing the outbound response traffic back to the clients without configuring any outbound rules.
Which combination of AWS security features will satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: A Network Access Control List (NACL) at the subnet level to deny the malicious IP addresses, and a Security Group at the instance level to allow inbound port 443 traffic

Cevap

A Network Access Control List (NACL) at the subnet level to deny the malicious IP addresses, and a Security Group at the instance level to allow inbound port 443 traffic
The correct option is the one specifying a Network Access Control List (NACL) at the subnet level to deny the malicious IP addresses, and a Security Group at the instance level to allow inbound port 443 traffic. A NACL operates at the subnet level and supports explicit deny rules, which satisfies the first requirement of blocking specific IP addresses. A Security Group operates at the instance level and is stateful, which automatically allows return traffic for any established inbound connection, meeting the second requirement without needing outbound rules.

Adım Adım Çözüm

1
Analyze the requirement to block malicious IP addresses before traffic reaches the subnet.
Identify that a Network Access Control List (NACL) is applied at the subnet boundary and supports explicit 'deny' rules to block specific IP addresses.
Security Groups only support 'allow' rules and cannot block specific IP addresses directly; therefore, a NACL is needed at the subnet boundary.
2
Analyze the requirement to allow inbound HTTPS traffic (port 443) and automatically permit outbound response traffic without outbound rules.
Identify that Security Groups are stateful firewalls that operate at the instance level, allowing return traffic automatically without needing corresponding outbound rules.
NACLs are stateless and require explicit outbound rules for return traffic, which violates the requirement of not needing outbound rules.

Anahtar Kavram

Stateful vs. Stateless network filtering in AWS VPC (Security Groups vs. Network ACLs)
ÖncekiSayfa 22 / 23Sonraki
Security and Compliance Alıştırma Soruları — AWS Certified Cloud Practitioner — Sayfa 22 | Examkin