Q3Network Security, Compliance, and Governance
A company uses AWS Network Firewall to protect outbound traffic for multiple VPCs in the same AWS account. Each VPC contains Amazon EC2 instances that host the company’s applications. Every EC2 instance is tagged with the name of the application that it hosts. The EC2 instances are in Auto Scaling groups. A Network Firewall stateful rule group must stay current even when an Auto Scaling group launches or terminates EC2 instances. Which solution meets this requirement with the **LEAST** implementation and administrative effort?
← → navigate · a answer
Community votes
Discussion · 6
D 4
D: because a tag-based resource group can be created : see https://docs.aws.amazon.com/network-firewall/latest/developerguide/resource-groups.html
D 3
because:
Resource groups automatically update membership based on tags
No ongoing maintenance required once set up
Handles Auto Scaling events automatically
Minimal implementation effort (just create groups and reference ARNs)
No custom code or manual updates needed
Works with Network Firewall's native capabilities
B 3
D cannot be the anser as AWS Network Firewall does not support resource groups or ARNs as rule group match criteria.
D 2
https://docs.aws.amazon.com/network-firewall/latest/developerguide/resource-group-creating.html
use a resource group, include the resource group's Amazon Resource Name (ARN) in a stateful rule's IP set reference. For information about using resource groups in IP set references
B 2
Prefix lists in AWS are dynamic collections of IP address ranges (CIDR blocks) that can be referenced within Network Firewall rules. When you maintain and update a prefix list to include the subnets where your Auto Scaling groups operate, the Network Firewall rules automatically apply to any new instances launched in those subnets.
❌ D. Resource groups cannot be referenced in firewall rule groups.
----AWS Network Firewall does not support referencing resource groups in rule groups.
1
But you cannot reference the ARN of the resource group in the rule
https://docs.aws.amazon.com/network-firewall/latest/developerguide/resource-group-settings.html