Network Access Control Lists (NACLs) and Network Security Groups (NSG) CSE Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A cloud architect is explaining the difference between NACLs and NSGs to a junior engineer. Which statement accurately describes a key difference?

   • ANACLs support only allow rules, while NSGs support both allow and deny rules.
   • BNACLs are stateless and require explicit rules for both inbound and outbound traffic, while NSGs are stateful and automatically allow return traffic.
   • CNACLs are applied at the instance level, while NSGs are applied at the subnet level.
   • DNACLs are stateful and automatically allow return traffic, while NSGs are stateless and require explicit rules for both directions.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is implementing a defense-in-depth strategy for its cloud network. They have a public-facing web tier and a private application tier. They want to ensure that even if an instance-level firewall is misconfigured, the subnet boundaries still provide protection. Which approach best achieves this?

   • AUse a single NACL for all subnets with permissive rules, and rely on the cloud provider's default security.
   • BUse only NACLs on each subnet, with no instance-level controls, to reduce complexity.
   • CUse NACLs on each subnet to enforce subnet-to-subnet traffic flows, and use NSGs on each instance to enforce instance-specific rules.
   • DUse only NSGs on each instance, with no subnet-level controls, to simplify management.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is deploying a new application in a VPC. They want to ensure that the application tier can only be accessed by the web tier, and the database tier can only be accessed by the application tier. They also want to ensure that the web tier is accessible from the internet on port 443. Which combination of NACLs and NSGs should they use?

   • AUse a single NACL for all subnets with permissive rules, and rely on NSGs for all filtering.
   • BUse only NACLs on each subnet to enforce the required traffic flows, and do not use NSGs.
   • CUse only NSGs on each instance to enforce the required traffic flows, and do not use NACLs.
   • DUse a NACL on each subnet to enforce the required traffic flows, and use NSGs on each instance to enforce the same rules for defense-in-depth.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When using both NACLs and NSGs, what is a recommended best practice?

   • AUse only NSGs because they are stateless and more secure.
   • BUse NSGs for broad subnet-level rules and NACLs for fine-grained resource-level rules.
   • CUse only NACLs because they are stateful and easier to manage.
   • DUse NACLs for subnet-level rules and NSGs for resource-level rules.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security architect is designing network security for a financial application. The compliance team requires that all traffic between the web and application tiers be explicitly allowed, and that any traffic not explicitly allowed be denied. The architect wants to implement this using both NACLs and NSGs. The application tier is in a private subnet, and the web tier is in a public subnet. The architect must also ensure that the application tier cannot be reached from the internet. Which approach best meets the compliance and security requirements?

   • AConfigure only NSGs on the instances, and do not use NACLs, because NSGs are stateful and provide better security.
   • BConfigure NACLs on both subnets to allow only the necessary traffic between tiers and deny all other traffic, and configure NSGs on each instance to allow only the required traffic.
   • CConfigure NACLs on the subnets to allow all traffic between tiers, and configure NSGs on the instances to deny all traffic except the necessary traffic.
   • DConfigure NSGs on the instances to allow only the necessary traffic, and rely on the default NACL rules to deny all other traffic.
   Reveal Solution Discussion Select an answer first