Your entire AWS infrastructure lives inside of one Amazon VPC.

Previous Question
Next Question

Your entire AWS infrastructure lives inside of one Amazon VPC. You have an Infrastructure monitoring application
running on an Amazon instance in Availability Zone (AZ) A of the region, and another application instance running in AZ
B)The monitoring application needs to make use of ICMP ping to confirm network reachability of the instance hosting the
application. Can you configure the security groups for these instances to only allow the ICMP ping to pass from the
monitoring instance to the application instance and nothing else” If so how?

A.
No. Two instances in two different AZ’s can’t talk directly to each other via ICMP ping as that protocol is not allowed across subnet
(iebroadcast) boundaries.

B.
Yes. Both the monitoring instance and the application instance have to be a part of the same security group, and that security group
needs to allow inbound ICMP.

C.
Yes. The security group for the monitoring instance needs to allow outbound ICMP and the application instance’s security group needs
to allow Inbound ICMP.

D.
Yes. Both the monitoring instance’s security group and the application instance’s security group need to allow both inbound and
outbound ICMP ping packets since ICMP is not a connection-oriented protocol.

Explanation:
Even though ICMP is not a connection-oriented protocol, Security Groups are stateful.
“Security groups are stateful — responses to allowed inbound traffic are allowed to flow outbound regardless of outbound
rules, and vice versa.”
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html

Previous Question
Next Question

Leave a Reply

Your email address will not be published. Required fields are marked *