Security groups and network ACLs: SAA-C03 study notes and practice questions
What to know about Security groups and network ACLs for the SAA-C03 exam, from the Design Secure Architectures domain (30% of the exam guide), then 3 free questions to test it. Part of the SAA-C03 study guide.
Network security questions on SAA-C03 usually come down to one of three choices: security group or network ACL, public or private subnet, and internet path or private path (VPC endpoint).
Security groups vs network ACLs
Security group
Network ACL
Applies to
Elastic network interfaces (instances, load balancers, RDS, Lambda in a VPC)
A whole subnet
Rules
Allow only
Allow and deny
State
Stateful: return traffic is allowed automatically
Stateless: return traffic needs its own rule (ephemeral ports)
Evaluation
All rules together
In order, lowest rule number first; first match wins
Can reference
Other security groups
CIDR ranges only
Key facts
To block a specific IP range, use a network ACL deny rule numbered lower than the allow rule. Security groups can’t deny.
Reference security groups, not IP addresses, between tiers: allow the app tier only from the load balancer’s security group, and the database only from the app tier’s. It keeps working as instances come and go.
Private subnets have no route to an internet gateway. Instances there reach the internet outbound through a NAT gateway in a public subnet, and nothing can start a connection to them from the internet.
Gateway endpoints (S3 and DynamoDB only) add a route to the route table, are free, and keep traffic off the internet. Interface endpoints (AWS PrivateLink) put an ENI in your subnet for most other services, cost per hour and per GB, and can be reached from on premises over VPN or Direct Connect.
Endpoint policies and bucket policies work together: an S3 bucket policy with aws:SourceVpce can refuse any request that didn’t come through your endpoint.
Common traps
Using a security group to “deny” traffic. Not possible; remove the allow or use a network ACL.
Forgetting ephemeral ports on a network ACL. Responses leave on high-numbered ports, so a stateless ACL that only allows port 443 inbound breaks replies unless outbound 1024-65535 is allowed.
Sending S3 traffic through a NAT gateway. It works, but costs more and leaves the VPC; a gateway endpoint is cheaper and more private.
Putting web servers in a public subnet “for the load balancer”. Only the load balancer needs to be public.
A retailer is launching a web application with the network design shown in the diagram. An internet-facing Application Load Balancer (ALB) in the public subnets forwards HTTPS requests to web servers in two Availability Zones.
A security review of the first test deployment found that the launch template puts the web servers in the public subnets with public IPv4 addresses, and that their security group allows HTTPS from 0.0.0.0/0.
The web servers must be reachable only through the ALB.
Which TWO actions should a solutions architect take? (Choose two.)
Read a full description of the diagram
A VPC spans two Availability Zones. Each zone has a public subnet and a private subnet. An internet gateway is attached to the VPC. The Application Load Balancer has a node in each public subnet. Web servers on EC2 sit in each private subnet. Arrows show user traffic going from the internet, through the internet gateway, to the load balancer, and then to the web servers.
Choose two answers.
AA. Change the web servers' security group so that it allows inbound HTTPS only from the security group that is attached to the ALB.
BB. Update the launch template to use the private subnets and to stop assigning public IPv4 addresses to the web servers.
CC. Add a network ACL rule to the private subnets that allows inbound HTTPS only from the ALB's security group, and deny everything else.
DD. Recreate the ALB with the internal scheme so that its nodes have only private IP addresses inside the VPC.
EE. Keep HTTPS open to 0.0.0.0/0 on the web servers, and attach an AWS WAF web ACL to the ALB to filter requests.
B. Right: Correct. Servers in private subnets with no public IP address have no route from the internet, which matches the diagram. The ALB reaches its targets on their private IP addresses, so nothing else needs to change. Learn more: How Elastic Load Balancing works (opens in a new tab)
C. Wrong: Network ACL rules match traffic by CIDR range, not by security group, so this rule cannot be written. A network ACL is also stateless, so return traffic would need its own rules. The security group reference belongs on the web servers' security group. Learn more: Network ACL rules (opens in a new tab)
D. Wrong: An internal load balancer can only route requests from clients that have access to the VPC. Customers on the internet could no longer reach the application at all. The ALB must stay internet-facing; it is the web servers that must be private. Learn more: How Elastic Load Balancing works (opens in a new tab)
Use two layers. Placing the web servers in private subnets without public IP addresses removes any direct path from the internet, and allowing inbound HTTPS only from the ALB's security group means that even traffic from inside the VPC must come through the load balancer. Network ACLs cannot reference security groups, an internal ALB would cut off customers, and AWS WAF does not protect traffic that bypasses the ALB.
A news website runs on Amazon EC2 instances in one public subnet, and the instances use several different security groups.
Monitoring shows a flood of malicious requests from the address range 203.0.113.0/24 to every instance in the subnet. The subnet's network ACL has inbound rule 100, which allows HTTPS from 0.0.0.0/0.
The team wants one change that blocks the range for the whole subnet while legitimate readers keep access.
What should a solutions architect do?
Choose one answer.
AA. Add inbound rule 50 to the subnet's network ACL that denies all traffic from 203.0.113.0/24.
BB. Add inbound rule 200 to the subnet's network ACL that denies all traffic from 203.0.113.0/24.
CC. Add an inbound rule that denies traffic from 203.0.113.0/24 to each of the security groups used by the instances.
DD. Remove the 0.0.0.0/0 HTTPS rules from the security groups, and allow only the address ranges of known readers.
B. Wrong: This is the right place but the wrong order. HTTPS from the bad range matches rule 100 first and is allowed, so rule 200 is never reached for that traffic. The deny must have a lower number than the allow rule. Learn more: Network ACL rules (opens in a new tab)
C. Wrong: Security groups support allow rules only, so a deny rule cannot be added. Changing several security groups would also not be the single change the team asked for. Use a network ACL deny rule for the subnet. Learn more: Security group rules (opens in a new tab)
Network ACLs are stateless, subnet-level filters that support both allow and deny rules, evaluated in order from the lowest rule number. A deny for 203.0.113.0/24 numbered below the existing allow rule blocks the range for every instance in the subnet with one change. Security groups are allow-only and apply per instance.
A company runs AWS Lambda functions in private subnets of a VPC so that they can query an Amazon RDS database in the same subnets.
The functions must now also read and write items in an Amazon DynamoDB table. The security team does not allow any route from these subnets to the internet, and the company wants the lowest ongoing cost.
What should a solutions architect do?
Choose one answer.
AA. Add a NAT gateway in a new public subnet, and route the private subnets' traffic for DynamoDB through the NAT gateway.
BB. Create an interface VPC endpoint for DynamoDB in each Availability Zone used, with a security group that allows HTTPS from the functions.
CC. Create a gateway VPC endpoint for DynamoDB, and add it to the route tables of the private subnets that the functions use.
DD. Remove the VPC configuration from the functions so they reach DynamoDB directly, and connect to the database through an RDS Proxy.
Show the answer and explanation
Answer: C
A. Wrong: A NAT gateway gives the subnets a route to the internet, which the security team does not allow. It also has hourly and per-GB processing charges. A gateway endpoint reaches DynamoDB with no internet route and no charge. Learn more: NAT gateways (opens in a new tab)
B. Wrong: DynamoDB supports interface endpoints, and this keeps traffic private. However, interface endpoints are charged per hour in each Availability Zone and per GB processed. The gateway endpoint does the same job here at no extra charge. Learn more: AWS PrivateLink FAQs (opens in a new tab)
C. Right: Correct. A gateway endpoint adds a route to DynamoDB in the chosen route tables, so traffic stays on the AWS network without an internet or NAT gateway. There is no additional charge for gateway endpoints. Learn more: Gateway endpoints for Amazon DynamoDB (opens in a new tab)
Gateway VPC endpoints for Amazon S3 and DynamoDB add a route table entry that sends traffic for the service over the AWS network, with no internet gateway, NAT gateway or extra charge. DynamoDB also supports interface endpoints, which are needed for on-premises or cross-Region access but cost more. Moving the functions out of the VPC would cut them off from the database.
A gateway endpoint for DynamoDB adds a route, so the functions reach the table with no NAT gateway and no extra charge.
Want more on Security groups and network ACLs? The 5 full-length practice sets have 10 more Security groups and network ACLs questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
