Stateful behavior of security groups in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does it mean that AWS security groups are stateful?

It means that if you allow incoming traffic on a port, the response traffic is automatically allowed back out, without needing a separate rule.

beginner

How does stateful behavior simplify managing network rules?

You only need to create rules for incoming or outgoing traffic, not both, because the return traffic is automatically allowed.

beginner

If you allow inbound HTTP traffic on port 80, what happens to the outbound response traffic?

The outbound response traffic is automatically allowed by the security group because of its stateful nature.

intermediate

What is the difference between stateful and stateless firewalls in terms of traffic rules?

Stateful firewalls remember connections and allow return traffic automatically; stateless firewalls require explicit rules for both directions.

intermediate

Can you block outbound traffic in a security group if inbound traffic is allowed?

Yes, you can block outbound traffic by not allowing it explicitly, even if inbound traffic is allowed, but response traffic to inbound requests is still allowed automatically.

What happens to response traffic in AWS security groups when inbound traffic is allowed?

A Response traffic is blocked by default.

B You must create a separate outbound rule.

C Response traffic is automatically allowed back out.

D Response traffic requires a NAT gateway.

AWS security groups are stateful, so response traffic is automatically allowed without extra rules.

Which of the following best describes a stateful firewall?

A It only filters traffic based on IP addresses.

B It blocks all traffic unless explicitly allowed.

C It requires separate rules for inbound and outbound traffic.

D It tracks connections and allows return traffic automatically.

Stateful firewalls remember connection states and allow return traffic automatically.

If you want to allow outbound traffic but block inbound traffic, what should you do in a security group?

A Allow outbound rules and do not allow inbound rules.

B Allow inbound rules and block outbound rules.

C Allow both inbound and outbound rules.

D Block both inbound and outbound rules.

To allow outbound traffic only, create outbound rules and do not allow inbound traffic.

Why do you not need to create outbound rules for response traffic in security groups?

A Because security groups are stateful and allow response traffic automatically.

B Because outbound traffic is always allowed by default.

C Because AWS blocks outbound traffic automatically.

D Because response traffic uses a different port.

Stateful behavior means response traffic is allowed automatically without outbound rules.

Which statement is true about security groups in AWS?

A They only control outbound traffic.

B They are stateful and track connection states.

C They are stateless and require rules for both directions.

D They require manual approval for response traffic.

AWS security groups are stateful and automatically allow return traffic.

Explain in your own words what it means that AWS security groups are stateful.

Think about how a conversation works and how replies are handled.

Describe how stateful behavior affects the way you write inbound and outbound rules in security groups.

Consider if you need to write rules for both directions or just one.