Examkin

Tüm alıştırma soruları

1462 soru

Tüm türler1,462Çoktan seçmeli739Çoklu seçim723
Soru 1461Soru →

A company has deployed a multi-VPC architecture in a single AWS Region with two peered VPCs: VPC A (CIDR 10.1.0.0/1610.1.0.0/16) and VPC B (CIDR 10.2.0.0/1610.2.0.0/16). VPC A hosts a fleet of autoscaling web servers within a security group named `sg-web`. VPC B hosts an internal microservice on Amazon EC2 instances within a security group named `sg-api`. The web servers must securely communicate with the internal microservice using HTTPS (port 443443). The network design must ensure that only the web servers in VPC A can access the microservice in VPC B, minimizing administrative overhead as the web server fleet scales.

Which configuration meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Add an inbound rule to the internal microservice security group (`sg-api`) that allows TCP port 443443 traffic where the source is the web server security group (`sg-web`).

Cevap

Add an inbound rule to the internal microservice security group (`sg-api`) that allows TCP port 443443 traffic where the source is the web server security group (`sg-web`).
The correct configuration is to add an inbound rule to the internal microservice security group that allows traffic on port 443443 from the web server security group. AWS allows security groups to reference other security groups in peered VPCs within the same Region. This ensures that only the instances associated with the web server security group can access the microservice, automatically adapting as the web server fleet scales and avoiding the need to manage individual IP addresses or allow the entire VPC A CIDR block.

Adım Adım Çözüm

1
Identify the communication path and required security controls between the peered VPCs.
VPC A and VPC B are peered, meaning private IP traffic can flow between them. Security groups are needed to control this traffic at the instance level.
Security groups act as firewalls at the instance level, which is ideal for restricting microservice access.
2
Determine the optimal source filter for the security group rule to satisfy least privilege and scalability.
Referencing the source security group (`sg-web`) allows traffic only from instances associated with that security group, dynamically adapting as instances scale.
Using CIDR blocks is too broad, and individual IP addresses require excessive administrative overhead when instances scale.
3
Add the security group reference rule to the destination security group (`sg-api`).
Only traffic from instances in `sg-web` on port 443443 is allowed inbound to `sg-api` across the peered VPCs.
AWS supports referencing security groups in peered VPCs within the same Region, establishing a secure and maintainable connection.

Anahtar Kavram

Security Group Referencing Across Peered VPCs
Tahmini Süre:1m 30s
Soru 1462Soru →

An organization runs a batch-processing application on Amazon EC2 instances in a private subnet (Subnet A). The application needs to write processed data to an Amazon Redshift cluster located in a separate private database subnet (Subnet B) within the same VPC. The network security team requires that all network access be restricted to the minimum necessary ports and that return traffic must be securely allowed while maintaining strict boundaries.

Which combination of configuration steps will satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the Amazon Redshift cluster's security group, add an inbound rule allowing TCP port 54395439 from the batch-processing instances' security group.; In the Network ACL associated with Subnet B, add an inbound rule allowing TCP port 54395439 from Subnet A's CIDR block and an outbound rule allowing TCP ports 1024−655351024-65535 to Subnet A's CIDR block.

Cevap

In the Amazon Redshift cluster's security group, add an inbound rule allowing TCP port 54395439 from the batch-processing instances' security group; and in the Network ACL associated with Subnet B, add an inbound rule allowing TCP port 54395439 from Subnet A's CIDR block and an outbound rule allowing TCP ports 1024−655351024-65535 to Subnet A's CIDR block.
To secure the flow from Subnet A to Subnet B, Security Groups and Network ACLs must work together. The option allowing TCP port 54395439 inbound from the EC2 security group to the Redshift security group is correct because Security Groups are stateful. The option configuring both inbound traffic (port 54395439) and outbound traffic (ephemeral ports 1024−655351024-65535 for the response) in Subnet B's Network ACL is correct because Network ACLs are stateless.

Adım Adım Çözüm

1
Analyze the communication flow and port requirements.
The batch-processing instances (Subnet A) initiate TCP traffic to the Amazon Redshift cluster (Subnet B) on port 54395439.
Establishing the source, destination, protocol, and port is the first step in configuring security boundaries.
2
Configure the stateful firewall layer (Security Groups).
Create an inbound rule on the destination (Redshift) security group pointing to the source (batch EC2) security group. No outbound return rules are needed.
Security groups track connections dynamically, allowing return traffic automatically.
3
Configure the stateless firewall layer (Network ACLs).
On the destination subnet (Subnet B) Network ACL, add an inbound rule for TCP 54395439 from Subnet A CIDR, and an outbound rule for TCP 1024−655351024-65535 (ephemeral ports) to Subnet A CIDR.
Network ACLs do not track state, so return traffic must be explicitly allowed in the reverse direction.

Anahtar Kavram

Stateful vs. Stateless network filtering in AWS VPC using Security Groups and Network ACLs.
ÖncekiSayfa 74 / 74
Tüm alıştırma soruları — AWS Certified Solutions Architect - Associate | Examkin