A company deployed an Amazon EC2 instance to a VPC on AWS. A recent alert indicates that the EC2 instance is receiving a suspicious number of requests over an open TCP port from an external source…

Question

Options

• AUpdate the network ACL that is attached to the subnet that is associated with the EC2 instance.
• BUpdate the elastic network interface security group that is attached to the EC2 instance to remove
• CUpdate the elastic network interface security group that is attached to the EC2 instance by adding
• DCreate a new network ACL for the subnet. Deny all traffic from the EC2 instance to prevent data

• A
  71% (20)
• B
  14% (4)
• C
  11% (3)
• D
  4% (1)

Explanation

To address the issue of an Amazon EC2 instance receiving suspicious requests over an open TCP port, the most effective solution is to update the Network Access Control List (NACL) associated with the subnet where the EC2 instance resides. By adding a deny rule for the specific TCP port and source IP addresses involved in the suspicious activity, the security team can effectively block unwanted traffic at the subnet level. NACLs act as a stateless firewall for controlling traffic in and out of subnets, allowing for broad-based traffic filtering. This measure ensures that only legitimate traffic can reach the EC2 instance, thereby enhancing security without affecting the application's availability to other users. It's a more granular and immediate way to block specific traffic compared to modifying security group rules, which are stateful and apply at the instance level.

No community discussion yet for this question.