AWS Certified Cloud Practitioner CLF-C02 Exam QuestionsBrowse all questions from this exam

AWS Certified Cloud Practitioner CLF-C02 Exam - Question 95


Which AWS service or tool can be used to set up a firewall to control traffic going into and coming out of an Amazon VPC subnet?

Show Answer
Correct Answer: D

To set up a firewall to control traffic going into and coming out of an Amazon VPC subnet, you would use a Network ACL (Access Control List). Network ACLs act as a firewall at the subnet level, allowing or denying specific inbound and outbound traffic based on defined rules. They operate at the network layer and are specifically designed for managing traffic at the subnet level, making them the appropriate choice for this requirement.

Discussion

52 comments
Sign in to comment
pietro167Option: D
Dec 7, 2023

ACL = subnet, Security Groups = instances

reddy187
Jun 23, 2024

Correct : KeyWOrd: Subnet

Penny357Option: C
Dec 29, 2023

The Question states "AWS service or tool can be 'used' to set up a firewall" So option is C. And Network ACL is not a AWS service or tool. Correct me if i am wrong.

Rahul_Ghai
Jan 4, 2024

The term Service is a broader classification. The key point is that Network Access Control List acts as a firewall to secure virtual private clouds (VPCs) and subnets. NACLs control and manage traffic in subnets

BShelat
Jan 11, 2024

You are right. NACL is a list of rules. It is not a tool "to setup and manage" firewall. AWS Firewall Manager is a tool to setup, configure and manage AWS WAF and AWS Shield .

Taku2023
Feb 4, 2024

AWS firewall Manager has nothing to do with VPC subnets

nani12e434
Jan 13, 2025

If the focus is solely on "setting up a firewall for a VPC subnet," Network ACLs (NACLs) are technically the mechanism you'd use. However, if the question is interpreted as "which AWS tool could manage such configurations on a broader scale," AWS Firewall Manager becomes a relevant answer.

TheFivePipsOption: D
Jan 25, 2024

A. Security group: Acts as a virtual firewall for an Amazon EC2 instance. It controls inbound and outbound traffic at the instance level. While it's an essential component for controlling traffic to and from EC2 instances, it operates at the instance level, not at the subnet level. B. AWS WAF (Web Application Firewall): Focused on protecting web applications from common web exploits. It is used for filtering HTTP traffic and is not designed to control traffic at the VPC subnet level. C. AWS Firewall Manager: A service that helps manage AWS WAF rules across multiple accounts and resources. It is more about central configuration and management of WAF rules, rather than directly controlling traffic at the VPC subnet level. D. Network ACL (Access Control List): A set of rules that control inbound and outbound traffic at the subnet level. It operates at the network layer (Layer 3) and allows or denies traffic based on defined rules for a specific subnet. Network ACLs provide control over traffic entering and leaving a subnet within an Amazon VPC.

nocinfraOption: D
Oct 24, 2023

Network ACLs are an optional layer of security that act as a firewall for controlling inbound and outbound traffic at the subnet level. https://docs.aws.amazon.com/zh_tw/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison

Anuj08Option: D
Dec 24, 2023

Security groups and network ACLs are similar in that they allow you to control access to AWS resources within your VPC. But security groups allow you to control inbound and outbound traffic at the instance level, while network ACLs offer similar capabilities at the VPC subnet level.

TravisnicaOption: C
Jan 19, 2024

The question says "what service or tool can be used to set up a firewall" so C is the correct answer. It's known that VPC subnet must be associated with a network ACL. However, to set up the firewall you will use AWS Firewall Manager.

Taku2023
Feb 4, 2024

AWS Firewall Manager is a security management service that allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations.

AnyioOption: A
Oct 16, 2023

The correct answer is A. A security group acts as a firewall that controls the traffic allowed to and from the resources in your virtual private cloud (VPC). You can choose the ports and protocols to allow for inbound traffic and for outbound traffic. https://docs.aws.amazon.com/vpc/latest/userguide/security-groups.html

Derpowsky
Nov 26, 2023

Wrong, the security group works at the instance level, not the subnet level. The packet will never reach the security group if it doesn't pass through ACL.

asdfcdsxdfcOption: D
Nov 10, 2023

D is correct

rankocertifiedOption: D
Nov 17, 2023

Cannot be C: AWS Firewall Manager is a security management service that allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations. As new applications are created, Firewall Manager makes it easier to bring new applications and resources into compliance by enforcing a common set of security rules. therefore the only valid answer is D as it pertains to subnets (VPC)

SanePebbleOption: D
Nov 28, 2023

Key word is subnet

FulmiOption: D
Dec 6, 2023

ACL = subnet, Security Groups = instances

MarysSonOption: C
Mar 10, 2024

C is the correct answer. The AWS Firewall Manager helps to configure a firewall and that’s what this question is asking. ”AWS Firewall Manager simplifies your AWS WAF administration and maintenance tasks across multiple accounts and resources. With AWS Firewall Manager, you set up your firewall rules just once.” A – Security groups are essential to efficiently managing access to resources, but they are not classified as a service. B – Web application firewall is essential to controlling traffic into and out of a network, by setting access rules and monitoring network request, but this is not the best answer. D – Access Control Lists are used to grant or limit access to network and system resources, but they are not classified as a service. Reference: https://AWS Firewall Manager Documentation (amazon.com)

Val2344Option: D
May 14, 2024

The correct answer is D. Network ACL (Access Control List). Network ACLs act as a firewall for controlling traffic in and out of a subnet in Amazon Virtual Private Cloud (VPC). They operate at the subnet level and evaluate traffic based on rules defined for inbound and outbound traffic.

isaphiltrickOption: A
Oct 15, 2023

"A security group acts as a firewall that controls the traffic allowed to and from the resources in your virtual private cloud (VPC). You can choose the ports and protocols to allow for inbound traffic and for outbound traffic." Reference: https://docs.aws.amazon.com/vpc/latest/userguide/security-groups.html

juneslayerOption: D
Oct 18, 2023

A network access control list (ACL) allows or denies specific inbound or outbound traffic at the subnet level. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

MarkDillon1075Option: D
Oct 19, 2023

D - Subnet level, not instance level

geloNSEOption: D
Oct 23, 2023

Since we are on a subnet level, D is the correct answer. Network ACLs allow or deny inbound and outbound traffic at the subnet level. Security groups allow inbound and outbound traffic for associated resources, such as EC2 instances. https://docs.aws.amazon.com/vpc/latest/userguide/infrastructure-security.html#VPC_Security_Comparison

MAKI1619
Nov 4, 2023

Firewall Manager provides these benefits: Helps to protect resources across accounts Helps to protect all resources of a particular type, such as all Amazon CloudFront distributions Helps to protect all resources with specific tags Automatically adds protection to resources that are added to your account Allows you to subscribe all member accounts in an AWS Organizations organization to AWS Shield Advanced, and automatically subscribes new in-scope accounts that join the organization Allows you to apply security group rules to all member accounts or specific subsets of accounts in an AWS Organizations organization, and automatically applies the rules to new in-scope accounts that join the organization Lets you use your own rules, or purchase managed rules from AWS Marketplace

Sreeni_A
Nov 11, 2023

D is correct . AWS Subnet level - AWS Direct Connect

Sreeni_A
Nov 11, 2023

D is correct . AWS Subnet level - Network ACLS

EssentialDOption: D
Nov 13, 2023

subnet --> Network ACLs

BlikOption: D
Nov 14, 2023

SUBNET = NETWORK ACL

MohamedsadatOption: D
Nov 15, 2023

D because it out of VPC

tqiu654Option: D
Nov 18, 2023

GPT: To set up a firewall to control traffic going into and coming out of an Amazon VPC subnet, the most appropriate AWS service or tool is: D. Network ACL (Network Access Control List): Network ACLs act as a firewall for controlling traffic into and out of subnets within an Amazon VPC. They provide a layer of security at the subnet level by allowing you to specify both inbound and outbound traffic rules. These rules can allow or deny traffic based on protocol, source IP address, destination IP address, and port number.

cloudrishankOption: D
Nov 21, 2023

Nacl is at subnet level

db97Option: D
Dec 7, 2023

Network ACL: Traffic control to the VPC Security Group: Traffic control to the EC2 instance. Answer in this case is "D". Network ACL.

VikJo1978
Dec 9, 2023

The answer is A, Security Groups.

salthehashOption: A
Dec 13, 2023

To control traffic going into and coming out of an Amazon Virtual Private Cloud (VPC) subnet, you can use a combination of security groups and network access control lists (Network ACLs). However, specifically for setting up a firewall-like control at the instance level, you would use security groups.

jazkhanOption: D
Jan 9, 2024

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

BShelatOption: C
Jan 11, 2024

NACL, Security Groups and AWS WAF are all firewalls. AWS Firewall Manager service can be used as a central configuration and setup tool to mange all those firewalls scattered around your distributed environment having multiple VPC foot print. Hence the answer is "C". "Why go beyond NACL and Security Groups for ingress traffic filtering" section on the third link explains this concepts better. https://docs.aws.amazon.com/waf/latest/developerguide/fms-chapter.html https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html https://aws.amazon.com/blogs/networking-and-content-delivery/design-your-firewall-deployment-for-internet-ingress-traffic-flows/

OZGEGOKCHEOption: A
Jan 28, 2024

A. Security group To control traffic going into and coming out of an Amazon VPC subnet, you can use security groups. Security groups act as virtual firewalls at the instance level, allowing you to specify rules that control inbound and outbound traffic. They operate at the instance level, controlling traffic at the network level. The other options are also related to security, but they serve different purposes: B. AWS WAF (Web Application Firewall): Focuses on protecting web applications from common web exploits. C. AWS Firewall Manager: Manages the AWS WAF settings across your accounts and applications. D. Network ACL (Access Control List): An optional layer of security for your VPC that acts as a firewall for controlling traffic at the subnet level. While it’s a viable option, security groups are often more straightforward for basic traffic control.

Nilupul21
Mar 19, 2024

Correct answer is NACL Security Group is used for setup inbound and outbound rules in instance levels not in subnet levels. The question ask for a service or tool which serves at subnet levels. So, this answer is not correct. NACL: Allows to setup rules at subnet levels. So this is the correct answer. Firewall Manager: This is used for a broader perspective. It simplifies administration and maintenance tasks across multiple AWS accounts for variety of protections like WAF, Shield, Security Groups and Network Firewall etc.

ChhatwaniB
Jul 10, 2024

Answer D : Network Access Control Lists (NACLs) Act as a firewall to control traffic at the subnet level, allowing or denying specific inbound or outbound traffic.

FMORADELLOption: A
Nov 17, 2023

Security groups act as a virtual firewall for your instances, controlling inbound and outbound traffic at the instance level in an Amazon VPC. They are the most appropriate choice for controlling traffic within a subnet.

reachmevisa
Jan 24, 2024

D Network ACL https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

Ruffyit
Feb 2, 2024

D. Network ACL (Access Control List): An optional layer of security for your VPC that acts as a firewall for controlling traffic at the subnet level. While it’s a viable option, security groups are often more straightforward for basic traffic control.

LinuxChamp
Feb 13, 2024

D = CORRECT

andrei97
Feb 21, 2024

To set up a firewall to control traffic going into and coming out of an Amazon VPC (Virtual Private Cloud) subnet, you can use AWS Network Firewall. AWS Network Firewall is a managed service that makes it easy to deploy essential network protections for your VPCs. It allows you to create firewall rules and enforce them at the perimeter of your VPC. With AWS Network Firewall, you can define rules based on IP addresses, ports, protocols, and other criteria to allow or deny traffic. It integrates with AWS Firewall Manager for centralized management across multiple accounts and VPCs. C - correct By using AWS Network Firewall, you can effectively control inbound and outbound traffic to and from your VPC subnets, enhancing the security posture of your AWS infrastructure.

bd29Option: A
Feb 22, 2024

A. Security Group is the primary method.

homodeus
Mar 14, 2024

They phrase is "...to control traffic going into and coming out of an Amazon VPC subnet?". It is NACL. D

Gallileo9Option: D
Apr 25, 2024

Network ACL

chalakaOption: D
Apr 28, 2024

D. Network ACL (Access Control List) Network ACLs act as a firewall for controlling traffic at the subnet level. They are stateless and operate at the subnet level, allowing or denying traffic based on rules defined for inbound and outbound traffic. Network ACLs provide an added layer of security by allowing you to specify rules that govern traffic at the network level, complementing the security groups that operate at the instance level.

Anonymous
May 10, 2024

ACL = sub-rede, grupos de segurança = instâncias (by pietro167) Perfect

geocisOption: D
Jun 18, 2024

Like Pietro167 stated Network ACL = Subnet | Security Groups = Instances

EvilBeaverOption: D
Jul 29, 2024

As stated in the question, we're looking for a mechanism to control the subnet traffic, so it's a NACL.

Kilobay1Option: D
Sep 16, 2024

Network ACLs are used to control inbound and outbound traffic at the subnet level within an Amazon VPC. They provide a way to set up a firewall that operates at the network layer and are applied to all instances within a subnet.

ShaiTayOption: D
Nov 14, 2024

D. Network ACL - key word is subnet

SrikanthNLOption: C
Dec 12, 2024

TOOL, FIREWALL MANAGER = TOOL and is superset of NACL

Amin_013Option: D
Dec 30, 2024

Network ACLs are used to control inbound and outbound traffic at the subnet level within an Amazon VPC. They provide a way to set up a firewall that operates at the network layer and are applied to all instances within a subnet.

Smile03Option: D
Jan 26, 2025

A: Security group acts as a virtual firewall for your EC2 instances to control incoming and outgoing traffic. Inbound rules control the incoming traffic to your instance, and outbound rules control the outgoing traffic from your instance. When you launch an instance, you can specify one or more security groups. If you don't specify a security group, Amazon EC2 uses the default security group for the VPC. After you launch an instance, you can change its security groups. C: Your VPC automatically comes with a modifiable default network ACL. By default, it allows all inbound and outbound IPv4 traffic and, if applicable, IPv6 traffic. You can create a custom network ACL and associate it with a subnet to allow or deny specific inbound or outbound traffic at the subnet level.

6ce3034Option: D
Mar 2, 2025

The correct answer is: D. Network ACL Explanation: A Network Access Control List (Network ACL) is a security layer at the subnet level that controls inbound and outbound traffic for Amazon VPC. It acts as a firewall for controlling traffic going in and out of subnets, providing stateless filtering based on rules.

Hokage25
Mar 28, 2025

You are wrong - read carefully question and your explanation. The trick is in the question - and coming out (of an Amazon VPC subnet) "OF AN VPC Subnet" - it means that is over subnet. As you answer - Network (ACL) - security layer (AT THE) subnet level. - it mean it is in subnet

Hokage25Option: C
Mar 28, 2025

Read carefully its`s a TRAP : "control traffic going into and coming out of an Amazon VPC subnet" - NOT AT SUBNET LEVEL in my opinion it means that - control traffic at higher level that VPC subnet. My answer is C - AWS Firewall manager My explanation: network (ACL) allows or denies specific inbound or outbound traffic AT THE subnet level