Network Access Control Lists (NACLs) and Network Security Groups (NSG) CSE Practice Questions (Page 4)

Questions 16–18

1. 16application · medium

   A company is deploying a multi-tier web application in a cloud VPC. The web tier must be reachable from the internet on port 443, the application tier should only accept traffic from the web tier, and the database tier should only accept traffic from the application tier. The security team wants to enforce these rules at the subnet boundary as a first line of defense, while also allowing per-instance customization. Which combination of controls should they use?

   • AAttach a NACL to each subnet with rules for the required traffic, and attach NSGs to each instance or network interface for additional fine-grained control.
   • BUse only NSGs on the instances and skip NACLs, because NSGs can also filter traffic at the subnet level.
   • CAttach NSGs to each subnet and NACLs to each instance, with identical rules in both places.
   • DUse only NACLs on the subnets and do not use NSGs, because NACLs provide both stateless filtering and stateful tracking.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which statement correctly describes a key difference between NACLs and NSGs?

   • ANACLs are applied to individual VMs, while NSGs are applied to subnets.
   • BNACLs operate at the subnet level, while NSGs can operate at the network interface level.
   • CNACLs and NSGs both operate at the application layer.
   • DNACLs are stateful, while NSGs are stateless.
   Reveal Solution Discussion Select an answer first
3. 18application · medium

   A startup is deploying a three-tier application in a single VPC. The web tier must be reachable from the internet on port 443. The application tier should only accept traffic from the web tier, and the database tier should only accept traffic from the application tier. The security team wants to enforce these rules at the subnet boundary as an additional layer of defense beyond instance-level controls. Which configuration should the team use?

   • AUse security groups on the instances and configure the web tier's security group to allow traffic from the internet, with no subnet-level filtering.
   • BApply a single NACL to all three subnets with rules that allow all traffic between the subnets and deny internet traffic.
   • CAttach an NSG to each subnet and configure allow rules for the required source-destination pairs, relying on the stateful nature of NSGs.
   • DCreate a NACL for each subnet, with allow rules for the required source-destination pairs and deny rules for all other traffic.
   Reveal Solution Discussion Select an answer first