An application team assumes that the network security group protecting its web and application subnets will detect and stop malware moving between workloads inside allowed connections. Which statement correctly addresses that assumption?
Select an answer to reveal the explanation.
Short Explanation
Think of your security group as a bouncer checking names on a guest list; it doesn't open anyone's bag. If malware walks in with an invited guest, the bouncer waves it through. The trap is treating a packet filter as if it were an IPS.
Full Explanation
Network security groups are stateful filters that permit or deny traffic based on source and destination addresses, ports and protocols. They do not examine payloads, so traffic that matches an allowed rule passes regardless of what it carries. Detecting malware or exploit attempts inside permitted connections requires traffic inspection, such as a virtual intrusion prevention system, a next-generation firewall with content inspection, or host-based protection on the workloads. Claiming the group inspects payloads for signatures attributes a capability it does not have; stateful tracking follows connection state, not content. Denying all inbound traffic would break the application and still would not inspect what moves on the connections that must remain open between tiers. Flow logs record metadata about connections for later analysis; they neither inspect content nor block anything. Exam caveat: the outline lists network security groups and traffic inspection as separate network security examples precisely because they do different jobs, and both are usually needed. Operational check: map east-west flows between the web and application tiers, confirm which of them pass through an inspection point, and add inspection or host-based detection where sensitive traffic currently passes through filtering alone.