SAA-C03 practice question: Security groups and network ACLs (2 of 3)

Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A news website runs on Amazon EC2 instances in one public subnet, and the instances use several different security groups.

Monitoring shows a flood of malicious requests from the address range 203.0.113.0/24 to every instance in the subnet. The subnet's network ACL has inbound rule 100, which allows HTTPS from 0.0.0.0/0.

The team wants one change that blocks the range for the whole subnet while legitimate readers keep access.

What should a solutions architect do?

Choose one answer.

A. Add inbound rule 50 to the subnet's network ACL that denies all traffic from 203.0.113.0/24.
B. Add inbound rule 200 to the subnet's network ACL that denies all traffic from 203.0.113.0/24.
C. Add an inbound rule that denies traffic from 203.0.113.0/24 to each of the security groups used by the instances.
D. Remove the 0.0.0.0/0 HTTPS rules from the security groups, and allow only the address ranges of known readers.

Show the answer and explanation

Answer: A

A. Right: Correct. Network ACLs apply to every instance in the subnet and support deny rules. Rules are evaluated from the lowest number up and the first match wins, so rule 50 blocks the range before rule 100 can allow it. Learn more: Control subnet traffic with network access control lists (opens in a new tab)
B. Wrong: This is the right place but the wrong order. HTTPS from the bad range matches rule 100 first and is allowed, so rule 200 is never reached for that traffic. The deny must have a lower number than the allow rule. Learn more: Network ACL rules (opens in a new tab)
C. Wrong: Security groups support allow rules only, so a deny rule cannot be added. Changing several security groups would also not be the single change the team asked for. Use a network ACL deny rule for the subnet. Learn more: Security group rules (opens in a new tab)
D. Wrong: Readers of a public news site come from anywhere, so there is no list of known ranges to allow. This would block legitimate readers and needs edits to several security groups. A network ACL deny for the one bad range is simpler. Learn more: Control traffic to your AWS resources using security groups (opens in a new tab)

Explanation

Network ACLs are stateless, subnet-level filters that support both allow and deny rules, evaluated in order from the lowest rule number. A deny for 203.0.113.0/24 numbered below the existing allow rule blocks the range for every instance in the subnet with one change. Security groups are allow-only and apply per instance.

SAA-C03 practice question: Security groups and network ACLs (2 of 3)

Explanation

Study

Keep practicing