Exam AWS Certified Security - Specialty topic 1 question 87 discussion

answer: C https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#eni-basics Source/destination checking "You must disable source/destination checks if the instance runs services such as network address translation, routing, or firewalls."

Answer is C: The key point in the question is "What configuration is necessary to allow the virtual security appliance to route the traffic?"

C Similar to NAT instance, you must disable source/destination checks if the instance runs services such as network address translation, routing, or firewalls. D, is not wrong..but it is not required, depends on the architecture. An inline virtual security appliance could be between 2 internal (private) subnet. Or could be not directly connected to IGW, and there's another hop between it and IGW. Which means, it could be deployed in a private subnet. D is not required, while C is required.

As per Aws documentation: You must disable source/destination checks if the instance runs services such as network address translation, routing, or firewalls.

c is a tradional mistake both on AWS and Azure when setting up virtual appliances

A. ACL cannot be disabled B. Promiscuous mode is for package capturing and also cannot be used in ENI. C. is for let traffic pass through it D. ???

Ans = C as the traffic is not destinated for the virtual appliance, you have to disable Source/Destinations checks

Answer is C. Basic for NAT Instance

Why many people selected "D. Place the security appliance in the public subnet with the internet gateway", is there no any information from question to show that the virtual appliance should be NAT device or route to the Internet. So, D is not correct. Answer must be C.

Ans: C

Answer is C. D does not relate to traffic routing.

C, basic configuration

C is the correct answer. To route means to move traffic from one subnet to another and you need to disable Source/Destination checks for this to happen. There is no mention of the firewall being used for internet traffic so we can assume it must be in a public subnet

C https://community.checkpoint.com/t5/Cloud-Network-Security/What-is-up-with-Disabling-Source-Destination-check-for-vSEC-in/td-p/7140

Ans > D https://aws.amazon.com/pt/blogs/networking-and-content-delivery/securing-egress-using-ids-ips-leveraging-transit-gateway/

The question doesn't mention if the appliance is on EC2 instance or a marketplace appliance. If a marketplace appliance, C might not be necessary. In my opinion, it should be D

An (D)