ANS-C01 · Question #286
A company uses AWS Network Firewall to protect outgoing traffic for multiple VPCs that are in the same AWS account. Each VPC contains Amazon EC2 instances that host the company's applications. Each…
The correct answer is B. Create a prefix list for each application. Reference the prefix list in the stateful rule group. Prefix Lists: AWS prefix lists are a simple way to manage IP address ranges that can be reused across security groups, route tables, and firewall rules. By creating a prefix list for each application, you can group the IP addresses of the EC2 instances that host a specific…
Question
A company uses AWS Network Firewall to protect outgoing traffic for multiple VPCs that are in the same AWS account. Each VPC contains Amazon EC2 instances that host the company's applications. Each EC2 instance is tagged with the name of the application it hosts. The EC2 instances are in Auto Scaling groups. A Network Firewall stateful rule group must remain up-to-date, even when an Auto Scaling group launches and terminates EC2 instances. Which solution will meet this requirement with the LEAST implementation and administrative effort?
Options
- ACreate a network ACL for each application. Reference the network ACL in the stateful rule group.
- BCreate a prefix list for each application. Reference the prefix list in the stateful rule group.
- CCreate an AWS Lambda function that queries the EC2 instance tags for each application name
- DCreate a resource group for each application name. Reference the Amazon Resource Name
How the community answered
(42 responses)- A2% (1)
- B76% (32)
- C7% (3)
- D14% (6)
Explanation
Prefix Lists: AWS prefix lists are a simple way to manage IP address ranges that can be reused across security groups, route tables, and firewall rules. By creating a prefix list for each application, you can group the IP addresses of the EC2 instances that host a specific application. Dynamic Updates with Minimal Effort: When EC2 instances are launched or terminated in Auto Scaling groups, the IP ranges can be dynamically updated in the prefix lists. This approach avoids manual updates to the stateful rule group while ensuring that the rule group remains up-to- Low Administrative Overhead: Referencing the prefix lists in the stateful rule group minimizes the administrative effort, as any changes to the prefix lists automatically reflect in the firewall rules without needing direct modifications to the rule group.
Community Discussion
No community discussion yet for this question.