Examkin

Soru

Zorluk: Çok zorStrengthening Identity, Access, and Network Security

An enterprise wants to improve the network and identity security posture for an existing multi-account architecture. Account A hosts an application running on Amazon EC2 instances in a private subnet within VPC-A. The application needs to communicate with a proprietary web service hosted in Account B behind an internal Application Load Balancer (ALB) in VPC-B. VPC-A and VPC-B are interconnected using AWS Transit Gateway. The application also needs to communicate with a public third-party REST API at api.partner.corp.

A solutions architect must meet the following security requirements:
- Prevent DNS tunneling exfiltration and restrict DNS resolution in VPC-A to only the internal domain of Account B (*.internal.corp) and the partner domain (api.partner.corp).
- Restrict network traffic between VPC-A and VPC-B such that only the EC2 instances in VPC-A can access the internal ALB in VPC-B, preventing any transitive traffic from other VPCs connected to the Transit Gateway.
- Enforce that the EC2 instances in VPC-A can only call the external partner API, blocking all other outbound HTTP/HTTPS internet traffic from VPC-A.

Which of the following actions should the Solutions Architect take to meet these security requirements? (Select TWO.)

  1. Configure a Route 53 Resolver DNS Firewall rule group with a rule to allow domain names matching *.internal.corp and api.partner.corp, followed by a rule to block all other domains, and associate this rule group with VPC-A. Implement an AWS Network Firewall firewall in VPC-A and route outbound internet traffic through it, configuring a stateful rule group that allows HTTP/HTTPS traffic targeting api.partner.corp while blocking all other outbound destinations.Cevap
  2. In the security group attached to the internal ALB in VPC-B, allow inbound traffic only from the specific private IP addresses of the EC2 instances in VPC-A. In the Transit Gateway route tables, associate the VPC-A attachment with a route table containing a route to VPC-B, and associate the VPC-B attachment with a route table that contains a route to VPC-A but has no routes or propagation configurations to other VPCs.Cevap
  3. C
    Create a Service Control Policy (SCP) at the Organization root that denies all network traffic to domains other than *.internal.corp and api.partner.corp, and attach it to Account A. In the security group of the internal ALB in VPC-B, authorize the IAM role of the EC2 instances in VPC-A as the principal source.
  4. D
    Configure a Route 53 Private Hosted Zone for the external domain api.partner.corp in Account B, and associate it with VPC-A. Add an AWS WAF WebACL to the NAT Gateways in VPC-A with a rule configured to allow traffic only when the host header matches api.partner.corp and block all other traffic.
  5. E
    Configure a Direct Connect Gateway to route traffic between VPC-A and VPC-B transitively, bypassing the Transit Gateway. Configure Route 53 Resolver endpoints in VPC-A to forward all DNS queries to a private hosted zone in VPC-B that has a wildcard rule blocking DNS exfiltration.

Cevap

Configure a Route 53 Resolver DNS Firewall rule group to allow only specific domains and drop all others, while routing outbound HTTP/HTTPS traffic through AWS Network Firewall configured to permit api.partner.corp. Simultaneously, limit Transit Gateway routing propagation and restrict VPC-B's ALB security group to allow inbound traffic only from the EC2 instances in VPC-A.
To satisfy the requirements, the solutions architect must configure a Route 53 Resolver DNS Firewall rule group to allow only specific domains (*.internal.corp and api.partner.corp) and block all others, which blocks DNS exfiltration and tunneling. To filter egress web traffic, AWS Network Firewall must be used to inspect HTTP/HTTPS traffic to the partner API. For network isolation, Transit Gateway route tables must be configured to allow direct routing between VPC-A and VPC-B without propagating routes to other VPCs, and the target ALB's security group must explicitly whitelist the source EC2 instances' private IPs.

Adım Adım Çözüm

1
Implement Route 53 Resolver DNS Firewall in VPC-A.
DNS queries from VPC-A are restricted to the allowed domains (*.internal.corp and api.partner.corp), preventing DNS tunneling or exfiltration to unauthorized domains.
DNS Firewall evaluates DNS queries originating from the VPC and blocks queries to unapproved domains.
2
Deploy AWS Network Firewall in VPC-A and route outbound internet traffic through it.
Only HTTP/HTTPS traffic targeting api.partner.corp is allowed to egress VPC-A, while all other outbound internet traffic is blocked.
Network Firewall provides stateful domain list filtering for HTTP/HTTPS protocols, which cannot be achieved with security groups alone.
3
Configure Transit Gateway routing and update the destination ALB's security groups.
VPC-A and VPC-B can communicate with each other, but transitive routing from or to other VPCs is prevented. Only the private IPs of the application EC2 instances in VPC-A can access the internal ALB in VPC-B.
By isolating Transit Gateway route tables and locking down the ALB security group, network access is restricted to the minimum required path, preventing unauthorized lateral movement.

Anahtar Kavram

Continuous security improvement through DNS query filtering, outbound web inspection, and strict routing segregation.
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security