CCNA Infrastructure Security Questions

Proper infrastructure security relies on network isolation through private subnets and restrictive Security Group rules. By placing the RDS instance in a private subnet and configuring the application tier's security group to only permit inbound traffic on the database port from the application tier's specific security group, you minimize the attack surface. This defense-in-depth approach ensures lateral movement is blocked even if one tier is compromised.

AWS Systems Manager Session Manager provides a secure way to manage EC2 instances without needing to open inbound ports like 22 (SSH) or 3389 (RDP). It uses the SSM Agent to establish a secure tunnel, and access is controlled entirely through IAM policies, providing a robust audit trail of all commands.

Using a combination of AWS Systems Manager (SSM) and a VPC endpoint for SSM enables management of instances in private subnets without an Internet Gateway or NAT Gateway. This setup allows the SSM agent to communicate with the AWS Systems Manager service securely over the internal AWS network. This is the optimal infrastructure security design for maintaining patching compliance while adhering to strict network isolation requirements.

AWS WAF Managed Rules provide robust protection against common threats like SQL injection. However, to avoid false positives on legitimate technical content, running rules in 'Count' mode first allows for analysis of the impact. Once legitimate patterns are identified, exclusions or scope-down statements can be implemented before switching the rule to 'Block' mode.

Routing outbound traffic through a NAT Gateway ensures that instances can initiate communication with external endpoints while remaining entirely unreachable from the outside. NAT Gateways do not support inbound traffic initiation, providing a robust boundary. This design prevents direct exposure of private workloads, aligning with defense-in-depth principles for infrastructure security in AWS environments.

AWS Network Firewall supports both stateless and stateful rule groups. Stateful rule groups use the Suricata compatible engine, which allows for deep packet inspection (DPI) of application-layer protocols like HTTP. This enables the firewall to inspect headers, such as the 'Host' header, to enforce domain-based filtering policies.

The policy exhibit is incomplete because it lacks the 'Action' field, which is mandatory in AWS IAM and bucket policies. Without defining the action, the policy is syntactically invalid and will result in an 'Access Denied' error. Ensuring policy syntax is correct is a fundamental step in infrastructure security to prevent accidental service outages caused by misconfigured permissions or invalid JSON structures in resource-based policies.

Route 53 Resolver Query Logging allows you to log all DNS queries made by resources within your VPC. This includes queries for public domain names, internal VPC domain names, and even queries made via Route 53 Resolver DNS Firewall, providing the visibility needed to detect anomalies like DNS tunneling.

In a centralized inspection model, Transit Gateway (TGW) acts as the hub. Traffic from spoke VPCs must be routed to the TGW, which then uses a specific route table to forward traffic to the Security VPC. Appliance Mode must be enabled on the TGW attachment to ensure session stickiness for stateful firewalls.

Gateway Load Balancer (GWLB) is designed for deploying, scaling, and managing third-party virtual appliances. It uses the GENEVE protocol to wrap packets and maintain flow affinity, ensuring that both directions of a traffic flow are handled by the same appliance, which is critical for stateful inspection and security monitoring.

Security groups provide stateful packet filtering directly at the elastic network interface level, automatically allowing return traffic for established connections. Network Access Control Lists (NACLs) provide stateless packet filtering at the subnet boundary, requiring explicit rules for both inbound and outbound traffic. Using both provides complementary layers of defense.

AWS WAF rate-based rules track the number of requests from each IP address over a sliding 5-minute window. If the number of requests exceeds the defined limit (1,000 in this case), the action (Block) is triggered. The IP will remain blocked until its request rate falls below the threshold.

This bucket policy uses an explicit 'Deny' with a 'StringNotEquals' condition. This pattern is a powerful security control that implements a 'perimeter' around the bucket. It ensures that any request not originating from the specified VPC Endpoint (vpce-1a2b3c4d) is rejected, regardless of any other 'Allow' permissions the user might have.

Network ACLs (NACLs) are processed before Security Groups for inbound traffic entering a subnet. NACLs are stateless and process rules in numerical order. In this scenario, Rule 100 in the NACL explicitly denies traffic from the specific IP address, so the packet is dropped before it can be evaluated by the Security Group.

PrivateLink security is managed through a combination of service-level permissions and network-level monitoring. By adding specific AWS account ARNs to the endpoint service allowed principals list, you control which accounts can discover the service. Enabling VPC Flow Logs on the network interfaces associated with the endpoint provides the necessary metadata for auditing all connection attempts.