SCS-C02 Question 255
Select 3An organization is running a web application on Amazon EC2 instances in a public subnet. To enhance host-based security, the security team has mandated the implementation of a host-based firewall on the EC2 instances, in addition to using security groups and network ACLs. Which of the following actions should the team take to meet this requirement while maintaining optimal performance and manageability?
- A
Configure and enable iptables on each EC2 instance to filter inbound and outbound traffic.
- B
Use AWS Systems Manager to automate the deployment and configuration of a host-based firewall on all EC2 instances.
- C
Rely solely on Security Groups and Network ACLs for traffic filtering, as they are sufficient for most use cases.
- D
Install and configure a third-party host-based Intrusion Detection and Prevention System (IDPS) on each EC2 instance.
- E
Harden the EC2 instances by disabling unused ports and services and keeping the operating system updated.
Show answer and explanation
Correct answers: A, B, E
Explanation
To enhance host-based security, organizations should implement a host-based firewall, such as iptables, on EC2 instances to filter traffic at the instance level. Automating the deployment and configuration of the firewall using AWS Systems Manager ensures consistent implementation across instances. Additionally, hardening instances by disabling unused ports and services and keeping the operating system updated strengthens the overall security posture. While Security Groups and Network ACLs are important, they do not replace the need for host-based firewalls. Similarly, an IDPS, though useful, is not equivalent to a host-based firewall.
- A. Correct.
Correct: Using iptables on EC2 instances helps implement a host-based firewall, providing an additional layer of traffic filtering at the instance level.
- B. Correct.
Correct: AWS Systems Manager allows for centralized, automated deployment and management of software configurations, including a host-based firewall, ensuring consistency and reducing manual effort.
- C. Incorrect.
Incorrect: While Security Groups and Network ACLs are essential, they operate at the VPC level and do not provide host-based security. The question specifically asks for host-based firewall implementation.
- D. Incorrect.
Incorrect: While an IDPS can enhance security, the question specifically focuses on implementing a host-based firewall, which is a different solution.
- E. Correct.
Correct: Hardening the EC2 instances by disabling unused ports and services and keeping the OS updated is a best practice that complements host-based firewall configurations.