Stateful behavior of security groups in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

How does a security group handle return traffic?

You have an EC2 instance with a security group allowing inbound TCP traffic on port 80. What happens to the response traffic from the instance back to the client?

A Response traffic is allowed only if the inbound rule is set to allow all protocols.

B You must create an outbound rule to allow response traffic on port 80.

C Response traffic is blocked unless you add a rule for ephemeral ports.

D The security group automatically allows the response traffic without an explicit outbound rule.

💡 Hint

Think about how stateful firewalls track connections.

Security groups in AWS are stateful. This means that if inbound traffic is allowed, the response traffic is automatically allowed back out, even if there is no explicit outbound rule.

❓ service_behavior

intermediate

Outbound traffic behavior with no outbound rules

An EC2 instance has a security group with no outbound rules defined. What is the behavior of outbound traffic from this instance?

A Outbound traffic is allowed only if inbound rules permit it.

B Outbound traffic is allowed only on port 22.

C All outbound traffic is blocked because no outbound rules exist.

D All outbound traffic is allowed by default.

💡 Hint

Consider the default behavior of security groups regarding outbound rules.

By default, security groups allow all outbound traffic. However, if you remove all outbound rules, no outbound traffic is allowed.

❓ Architecture

advanced

Designing a security group for a web server with database access

You have a web server in a public subnet and a database server in a private subnet. The web server needs to accept HTTP traffic from the internet and connect to the database on port 3306. Which security group configuration correctly supports this while following best practices?

A Web server SG allows inbound HTTP from 0.0.0.0/0 and outbound MySQL to database SG; Database SG allows inbound MySQL from web server SG.

B Web server SG allows inbound HTTP from database SG and outbound MySQL to 0.0.0.0/0; Database SG allows inbound MySQL from 0.0.0.0/0.

C Web server SG allows inbound HTTP from 0.0.0.0/0 and inbound MySQL from database SG; Database SG allows inbound MySQL from web server SG.

D Web server SG allows inbound HTTP from 0.0.0.0/0 and outbound MySQL to 0.0.0.0/0; Database SG allows inbound MySQL from web server SG.

💡 Hint

Think about restricting access to only necessary sources and destinations.

The web server security group should allow inbound HTTP from anywhere and outbound MySQL traffic to the database security group. The database security group should allow inbound MySQL traffic only from the web server security group. This limits exposure and follows the principle of least privilege.

❓ security

advanced

Impact of removing inbound rules on existing connections

An EC2 instance has an active SSH session established through a security group rule allowing inbound TCP port 22. If you remove the inbound rule while the session is active, what happens to the SSH connection?

A The SSH session immediately drops as the inbound rule is removed.

B The SSH session remains active until closed by the client or server.

C The SSH session remains active but no new inbound SSH connections are allowed.

D The SSH session is paused until the inbound rule is added back.

💡 Hint

Consider how stateful security groups track existing connections.

Security groups are stateful, so existing connections remain active even if the inbound rule is removed. However, new inbound connections will be blocked.

✅ Best Practice

expert

Minimizing attack surface using security groups in a multi-tier application

You manage a multi-tier application with web, application, and database layers in separate subnets. To minimize the attack surface, which security group strategy is best?

A Allow inbound traffic only from the previous tier's security group and restrict all other inbound traffic.

B Allow inbound traffic from all subnets in the VPC to simplify connectivity.

C Allow inbound traffic from the internet to all tiers for flexibility.

D Allow inbound traffic only on port 22 from the internet to all tiers for management.

💡 Hint

Think about limiting access strictly between tiers.

Limiting inbound traffic to only the previous tier's security group reduces exposure and follows the principle of least privilege, minimizing the attack surface.