Exams / SCS-C03 / Study guide / Security groups, network ACLs, Network Firewall and DNS Firewall

Security groups, network ACLs, Network Firewall and DNS Firewall: SCS-C03 study notes and practice questions

What to know about Security groups, network ACLs, Network Firewall and DNS Firewall for the SCS-C03 exam, from the Infrastructure Security domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.

Last verified November 2026 against current AWS documentation ·How we write our questions

What to know for the exam

These questions describe a VPC where a rule must hold, such as blocking outbound traffic to known malicious domains, denying one IP range everywhere, or allowing a web tier to reach only one database port. You pick the lowest-effort control that enforces the rule at the right layer.

Security groups and network ACLs

Security groups attach to network interfaces. They hold allow rules only, and they are stateful: return traffic for an allowed connection is allowed automatically. A rule can reference another security group, which stays correct as IP addresses change.
Network ACLs apply to whole subnets. They hold numbered allow and deny rules, evaluated in order from the lowest number, and they are stateless. You must allow return traffic on ephemeral ports explicitly.
Use a network ACL deny to block an address range for every resource in a subnet. A security group cannot deny.

Read the network ACL guide for how rule numbers and ephemeral ports work.

Network Firewall and DNS Firewall

AWS Network Firewall places firewall endpoints in dedicated subnets and inspects traffic routed through them. Stateful rules can use Suricata-compatible signatures and domain lists that allow or deny web destinations by hostname. It can also perform TLS inspection. AWS Firewall Manager can apply its policies across accounts.
Route 53 Resolver DNS Firewall filters the DNS queries that resources in a VPC make. It uses managed domain lists, such as known malware and botnet domains, plus your own lists, and it can block, alert or allow.
Choose DNS Firewall when the threat is a domain lookup. It does not see traffic sent straight to an IP address.

Read the DNS Firewall overview to compare it with Network Firewall.

How to choose

Scenario wording	Pick
Allow only the app tier to reach the database port	Security group that references the app tier’s group
Block one malicious IP range across a subnet	Network ACL deny rule
Stop instances from resolving known malware domains	Route 53 Resolver DNS Firewall
Allow outbound HTTPS only to approved domains, with logs	Network Firewall domain list
Inspect VPC traffic with intrusion signatures	Network Firewall stateful rules
Block a web attacker’s address on an ALB	WAF IP set on the load balancer

Common traps

Security group rules that try to deny. Security groups cannot deny. Use a network ACL or Network Firewall.
Forgetting ephemeral ports in stateless network ACLs, which drops the responses.
Network Firewall for a DNS-only requirement when DNS Firewall handles it with less to run.
Broad CIDR ranges in security groups where a referenced group would be precise.
Assuming DNS Firewall blocks traffic to IP addresses. It acts on names only.

Side by side: Security groups vs network ACLs

Try the 1 practice question

Practice Security groups, network ACLs, Network Firewall and DNS Firewall Take the free practice exam

Question 1

Medium ·Link to this question

A SaaS company hosts its public API servers in a public subnet. Clients on the internet connect over HTTPS on port 443.

The security team uses a network ACL on that subnet that allows only inbound 443 and outbound 443. The security group allows inbound 443 from anywhere.

Since the network ACL change, some clients connect, send their request, and then time out waiting for a reply. The security team must keep the network ACL as a restrictive layer that allows only the ports the service needs, and the fix should change as little as possible.

Which change should the team make?

Choose one answer.

A. Add an outbound network ACL rule allowing TCP ports 1024 to 65535, so that server replies reach the clients. Leave the security group unchanged.
B. Open all inbound ports in the security group, since the clients time out and the security group must be blocking their traffic.
C. Add an inbound network ACL rule for the ephemeral ports, so that the clients' replies can come back into the subnet.
D. Replace the network ACL with one that allows all traffic in both directions, so that the subnet relies on the security group alone.

Show the answer and explanation

Answer: A

A. Right: Correct. Network ACLs are stateless, so the server replies need their own outbound rule for the ephemeral ports. The security group is stateful and already allows the replies for the connections it admitted, so it needs no change. Learn more: Network ACLs (opens in a new tab)
B. Wrong: The security group already allows the inbound request, because the requests reach the servers. The timeout comes from the reply leaving the subnet, so opening inbound ports changes nothing.
C. Wrong: The clients' replies are not the problem, because they arrive on the inbound rules that already work. The server replies are outbound traffic, so an inbound ephemeral rule would widen access without fixing the timeout.
D. Wrong: This fixes the timeout, but it removes the restrictive layer that the team must keep. It also allows every port, not only the ports that the service needs.

Explanation

Network ACLs are stateless, so return traffic on ephemeral ports needs its own outbound rule. Security groups are stateful and need no change for replies to already-admitted connections. Opening inbound ports, adding an inbound rule or removing the network ACL each miss the stated constraints.

Study

Want more on Security groups, network ACLs, Network Firewall and DNS Firewall? The 5 full-length practice sets have 5 more Security groups, network ACLs, Network Firewall and DNS Firewall questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Security groups, network ACLs, Network Firewall and DNS Firewall

What is AWS Network Firewall?