How should you configure Security Groups and Network ACLs to meet these requirements?
hard📝 Application Q9 of 15
AWS - Security Groups and Network ACLs
An application requires that all inbound traffic be logged and monitored at the subnet level, and only specific instances allow SSH access. How should you configure Security Groups and Network ACLs to meet these requirements?
AEnable VPC Flow Logs for instances; Network ACL restricts SSH; Security Groups allow all inbound
BEnable VPC Flow Logs for subnet; Network ACL allows all inbound; Security Groups restrict SSH per instance
CDisable VPC Flow Logs; Network ACL restricts SSH; Security Groups allow all inbound
DEnable VPC Flow Logs for subnet; Network ACL restricts SSH; Security Groups allow all inbound
Step-by-Step Solution
Solution:
Step 1: Enable VPC Flow Logs at subnet level
VPC Flow Logs capture traffic metadata for monitoring at subnet level.
Step 2: Configure Network ACL to allow all inbound traffic
Allow all inbound in NACL to avoid blocking traffic before instance-level filtering.
Step 3: Use Security Groups to restrict SSH access per instance
Security Groups provide fine-grained control to allow SSH only on specific instances.
Final Answer:
Enable VPC Flow Logs for subnet; Network ACL allows all inbound; Security Groups restrict SSH per instance -> Option B
