SCS-C03 · Question #126
A company operates an Amazon EC2 instance that is registered as a target of a Network Load Balancer (NLB). The NLB is associated with a security group. The security group allows inbound TCP traffic…
The correct answer is B. Add a new inbound rule that has a priority of 10 to the network ACL to deny TCP traffic on port 22. Network ACLs are stateless and are evaluated in order based on rule number, with lower rule numbers taking precedence. According to AWS Certified Security - Specialty incident response guidance, network ACLs can be used to immediately block traffic at the subnet level without…
Question
A company operates an Amazon EC2 instance that is registered as a target of a Network Load Balancer (NLB). The NLB is associated with a security group. The security group allows inbound TCP traffic on port 22 from 10.0.0.0/23. The company maps the NLB to two subnets that share the same network ACL and route table. The route table has a route for 0.0.0.0/0 to an internet gateway. The network ACL has one inbound rule that has a priority of 20 and that allows TCP traffic on port 22 from 10.0.0.0/16. A security engineer receives an alert that there is an unauthorized SSH session on the EC2 instance. The unauthorized session originates from 10.0.1.5. The company's incident response procedure requires unauthorized SSH sessions to be immediately interrupted. The instance must remain running, and its memory must remain intact. Which solution will meet these requirements?
Options
- ARestart the EC2 instance from either the AWS Management Console or the AWS CLI.
- BAdd a new inbound rule that has a priority of 10 to the network ACL to deny TCP traffic on port 22
- CRemove the security group rule that allows inbound TCP traffic on port 22 from 10.0.0.0/16.
- DUpdate the route table to remove the route to the internet gateway.
How the community answered
(42 responses)- A5% (2)
- B83% (35)
- C10% (4)
- D2% (1)
Explanation
Network ACLs are stateless and are evaluated in order based on rule number, with lower rule numbers taking precedence. According to AWS Certified Security - Specialty incident response guidance, network ACLs can be used to immediately block traffic at the subnet level without restarting instances or modifying their runtime state. By adding a deny rule with a lower priority number (10) that explicitly denies TCP traffic on port 22 from the offending IP address (10.0.1.5), the unauthorized SSH session is immediately interrupted. This approach satisfies the requirement to keep the instance running and to preserve memory for forensic analysis.
Topics
Community Discussion
No community discussion yet for this question.