SAA-C03 Question 327

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A6

  Security Groups operate at the transport layer (Layer 4) of the OSI model and are primarily concerned with controlling traffic based on IP addresses, ports, and protocols. They do not have the capability to inspect or filter traffic based on URLs. The solution to restrict outbound internet traffic based on specific URLs typically involves using a proxy or firewall that can inspect the application layer (Layer 7) of the OSI model, where URL information is available. AWS Network Firewall operates at the network and application layers, allowing for more granular control, including the ability to inspect and filter traffic based on domain names or URLs. By configuring domain list rule groups in AWS Network Firewall, you can specify which URLs are allowed for outbound traffic. This option is more aligned with the requirement of allowing access to approved third-party software repositories based on their URLs.

• Chose A4

  https://aws.amazon.com/network-firewall/features/ "Web filtering: AWS Network Firewall supports inbound and outbound web filtering for unencrypted web traffic. For encrypted web traffic, Server Name Indication (SNI) is used for blocking access to specific sites. SNI is an extension to Transport Layer Security (TLS) that remains unencrypted in the traffic flow and indicates the destination hostname a client is attempting to access over HTTPS. In addition, **AWS Network Firewall can filter fully qualified domain names (FQDN).**" Always use an AWS product if the advertisement meets the use case.

• Chose A2

  AWS Network Firewall • Protect your entire Amazon VPC • From Layer 3 to Layer 7 protection • Any direction, you can inspect Traffic filtering: Allow, drop, or alert for the traffic that matches the rules, • Active flow inspection to intrusion prevention