Security groups vs NACLs decision in AWS - Interactive Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify that security groups act as a {{BLANK_1}} firewall for instances.

AWS

Security groups act as a [1] firewall for instances in AWS.

Drag options to blanks, or click blank then click option'

Astateful

Bnetwork

Cstateless

Dapplication

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing security groups as stateless firewalls.

Thinking security groups operate at the network layer only.

Security groups are stateful, meaning they remember allowed connections and automatically allow return traffic.

2fill in blank

medium

Complete the code to specify that NACLs are {{BLANK_1}} and control traffic at the subnet level.

AWS

Network ACLs (NACLs) are [1] and control traffic at the subnet level.

Drag options to blanks, or click blank then click option'

Adynamic

Bstateful

Cstateless

Dapplication-layer

Attempts:

3 left

💡 Hint

Common Mistakes

Assuming NACLs automatically allow return traffic.

Confusing NACLs with security groups.

NACLs are stateless, so return traffic must be explicitly allowed by rules.

3fill in blank

hard

Fix the error in the statement: 'Security groups allow {{BLANK_1}} rules only, no deny rules.'

AWS

Security groups allow [1] rules only, no deny rules.

Drag options to blanks, or click blank then click option'

Adeny

Ballow

Cinbound

Dstateless

Attempts:

3 left

💡 Hint

Common Mistakes

Thinking security groups can deny traffic explicitly.

Confusing allow and deny rules.

Security groups only support allow rules; they do not support explicit deny rules.

4fill in blank

hard

Fill both blanks to complete the sentence: 'NACLs apply to {{BLANK_1}} and can have {{BLANK_2}} rules for inbound and outbound traffic.'

AWS

NACLs apply to [1] and can have [2] rules for inbound and outbound traffic.

Drag options to blanks, or click blank then click option'

Asubnets

Binstances

Cseparate

Dcombined

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing instances with subnets for NACL application.

Thinking inbound and outbound rules are combined.

NACLs apply at the subnet level and have separate rules for inbound and outbound traffic.

5fill in blank

hard

Fill all four blanks to complete the best practice: 'Use {{BLANK_1}} for instance-level security, {{BLANK_2}} for subnet-level control, and remember that {{BLANK_3}} are stateful while {{BLANK_4}} are stateless.'

AWS

Use [1] for instance-level security, [2] for subnet-level control, and remember that [3] are stateful while [4] are stateless.

Drag options to blanks, or click blank then click option'

Asecurity groups

BNACLs

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up which is stateful and which is stateless.

Confusing the resource level each controls.

Security groups protect individual instances and are stateful. NACLs protect subnets and are stateless.