Flashcards
AWS:Networking for increased security
Cards in this deck (4)
- 11:You work for a company that has been experiencing attacks on its network. Management has asked that your design a solution that will provide increased security for EC2 instances containing sensitive data, while still allowing employees to access the data when needed. Which of the following suggestions is best? Placing EC2 instances into private subnets is a great way to increase their security, since they will no longer be directly accessible from any host outside of the VPC. Adding a bastion host to the architecture will allow authorized users to gain access to the internal resources (instances in private subnets) while providing an additional "hardened" layer of security.2:True or False: A NAT Gateway will only allow return traffic if that traffic has been specifically asked for by an internal resource.
A NAT Gateway will not allow any unsolicited traffic through. All traffic that passes through it MUST have been asked for by a resource inside the VPC. - 23:You have provisioned several EC2 instances into private subnets; however, you now have the problem of not being able to download any new software packages or updates. Which if of the following provides the best solution?A NAT gateway provides the most secure solution for granting EC2 instances in private subnet the ability to download software packages. However, the NAT gateway MUST be placed in a public subnet, and a route to it must be created in the route table associated with the private subnets.
- 34:What best describes the difference between a bastion host and a NAT gateway?A bastion host is used is used as a "gateway" for traffic that is destined for instances located in a private subnet, whereas a NAT gateway provides instances in a private subnet with a route to the Internet. A NAT does provide protection for instances in a private subnet, but its primary goal is to allow instances in the private subnet a route to the Internet (to download software packages).
- 45:What are two primary requirements of a NAT Gateway (or NAT instance)?A NAT gateway must be provisioned into a public subnet (so that it has a route to the internet), and it must part of the private subnets route table (so that the private instances have a route to the NAT gateway). A NAT gateway does not require a bastion host to work (but can be used in combination).
Information
- Description
- Certified Solution Architect Associate AWS Certification Flashcards on AWS:Networking for increased security, created by Sarwesh Saurabh on 10/06/2017.
- Created by
- Sarwesh Saurabh
- Views
- 8
- Tags
- Rating