Network Access Control Lists (NACLs) and Network Security Groups (NSG) CSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A cloud architect is designing network security for a VPC. They need to apply a security layer that operates at the subnet boundary and is stateless. Which service should they use?

   • AVirtual Network Peering
   • BNetwork Access Control List (NACL)
   • CApplication Gateway
   • DNetwork Security Group (NSG)
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which resource can an NSG be associated with?

   • AOnly a network interface
   • BA network interface or a subnet
   • COnly a subnet
   • DOnly a virtual network
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is designing a new cloud environment and wants to implement a least-privilege security model. They have a web tier, an application tier, and a database tier. They want to ensure that the web tier can only be accessed from the internet on port 443, the application tier can only be accessed by the web tier, and the database tier can only be accessed by the application tier. They also want to ensure that management traffic (SSH/RDP) is only allowed from a bastion host. Which design best meets these requirements?

   • AUse only NSGs on each instance to allow the required traffic flows, with no NACLs.
   • BUse a NACL on the web subnet to allow internet traffic, and use NSGs on the application and database instances to allow traffic from the previous tier.
   • CUse separate NACLs for each subnet with rules that allow the required traffic flows, and use NSGs on each instance to allow management traffic from the bastion host.
   • DUse a single NACL for all subnets with rules that allow the required traffic flows, and use NSGs on each instance to allow management traffic from the bastion host.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which characteristic is true of a NACL?

   • AIt is stateful, so return traffic is automatically allowed.
   • BIt automatically denies all traffic by default, but you cannot add allow rules.
   • CIt is stateless, so you must define rules for both inbound and outbound traffic.
   • DIt only applies to inbound traffic, not outbound.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security engineer is reviewing the NACL and NSG configurations for a subnet that hosts a web application. The NACL has an inbound rule with rule number 100 that allows all traffic from 0.0.0.0/0. The NSG has an inbound rule with priority 100 that denies all traffic from 0.0.0.0/0, and a rule with priority 200 that allows HTTPS from 0.0.0.0/0. A user reports that they can access the web application over HTTPS. What is the most likely explanation?

   • AThe NACL's allow rule overrides the NSG's deny rule because NACLs are evaluated after NSGs.
   • BThe NSG's deny rule is not being applied because the NACL allows the traffic.
   • CThe NSG's deny rule has a lower priority than the allow rule, so the allow rule is applied.
   • DThe NSG is not associated with the subnet or the network interface of the web server.
   Reveal Solution Discussion Select an answer first