A solutions architect is explaining basic VPC security concepts to a new team member. The team is configuring security groups and Network Access Control Lists (NACLs) to secure a standard two-tier web application. Which TWO statements correctly describe the behavior or scope of these security resources?
- Security groups are stateful, meaning return traffic is automatically allowed regardless of inbound rules.Cevap
- Network ACLs are stateless, meaning return traffic must be explicitly allowed by outbound rules.Cevap
- CSecurity groups operate at the subnet level and apply to all resources in that subnet automatically.
- DNetwork ACLs are stateful, so allowing inbound traffic automatically permits the corresponding outbound response.
- ESecurity groups can inspect HTTP request payloads to block common Layer 7 web exploits.
Cevap
Security groups are stateful, meaning return traffic is automatically allowed, and Network ACLs are stateless, meaning return traffic must be explicitly allowed.
The correct statements are that security groups are stateful and network ACLs are stateless. Security groups automatically allow return traffic for any established connection they permit. Conversely, network ACLs do not track session state, which means both inbound and outbound paths must have explicit rule coverage to allow communications.
Adım Adım Çözüm
Anahtar Kavram
Statefulness and boundaries of VPC Security Groups versus Network ACLs