AWS Certified Specialty SCS-C01 Book

The outbound rules on the security group do not allow the response to be sent to the client on the ephemeral port range.

The outbound rules on the security group do not allow the response to be sent to the client on the HTTP port.

An outbound rule must be added to the network ACL to allow the response to be sent to the client on the ephemeral port range.

An outbound rule must be added to the network ACL to allow the response to be sent to the client on the HTTP port.

Use security groups to provide stateful firewalls for Amazon EC2 instances at the hypervisor level.

Use network ACLs to provide stateful firewalls at the VPC level to prevent access to any specific IAM resource.

Use IAM Direct Connect for secure trusted connections between EC2 instances within private subnets.

Design network security in a single layer within the perimeter network (also known as DMZ, demilitarized zone, and screened subnet) to facilitate quicker responses to threats.

The policy allows access for the IAM account 111122223333 to manage key access though IAM policies.

The policy allows all IAM users in account 111122223333 to have full access to the KMS key.

The policy allows the root user in account 111122223333 to have full access to the KMS key.

The policy allows the KMS service-linked role in account 111122223333 to have full access to the KMS key.

The policy allows all IAM roles in account 111122223333 to have full access to the KMS key.

Bucket1 only

Bucket2 only

Both bucket1 and bucket2

Neither bucket1 nor bucket2