Why security groups matter in AWS - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main purpose of a security group in AWS?

Imagine your house has a fence with a gate that only lets in people you trust. What does a security group do in AWS?

A It stores your data securely in the cloud.

B It automatically backs up your cloud resources every hour.

C It controls which traffic is allowed to reach your cloud resources by acting like a virtual firewall.

D It manages the billing and cost reports for your AWS account.

💡 Hint

Think about how you protect your house from strangers.

Security groups act like virtual fences that control inbound and outbound traffic to your cloud resources, ensuring only trusted traffic can access them.

❓ service_behavior

intermediate

What happens if you do not assign any inbound rules to a security group attached to an EC2 instance?

You launch a new EC2 instance and attach a security group with no inbound rules. What will happen when you try to connect to it?

A You will not be able to connect because no inbound traffic is allowed.

B You will be able to connect because AWS allows all inbound traffic by default.

C The instance will automatically create inbound rules to allow connections.

D The instance will reject all outbound traffic but allow inbound connections.

💡 Hint

Think about what happens if your fence has no gate.

Security groups deny all inbound traffic by default. Without inbound rules, no incoming connections can reach the instance.

❓ Architecture

advanced

Which security group configuration best protects a web server accessible only on HTTP and SSH from a specific IP?

You have a web server that should accept HTTP traffic from anyone and SSH only from your office IP 203.0.113.5. Which security group rules achieve this?

A Inbound rules: Allow TCP port 80 and 22 from 203.0.113.5/32

B Inbound rules: Allow TCP port 80 from 203.0.113.5/32; Allow TCP port 22 from 0.0.0.0/0

C Inbound rules: Allow TCP port 80 and 22 from 0.0.0.0/0

D Inbound rules: Allow TCP port 80 from 0.0.0.0/0; Allow TCP port 22 from 203.0.113.5/32

💡 Hint

HTTP should be open to all, SSH only to your office IP.

Allowing port 80 from anywhere lets anyone access the web server. Restricting port 22 to your office IP secures SSH access.

❓ security

advanced

What is the effect of adding an outbound rule that denies all traffic in a security group?

You add an outbound rule to a security group that denies all traffic. What will happen to the instances using this security group?

A Instances will be completely isolated, no inbound or outbound traffic allowed.

B The deny rule will be ignored because security groups only allow rules, not deny rules.

C Instances will be blocked from receiving inbound traffic but can send outbound traffic.

D Instances will not be able to send any outbound traffic, but inbound traffic is unaffected.

💡 Hint

Remember how security groups handle rules: allow or deny?

Security groups in AWS are stateful and only support allow rules. They do not support explicit deny rules. So deny rules are ignored.

✅ Best Practice

expert

Why is it recommended to use separate security groups for different application tiers (e.g., web, app, database)?

Consider a multi-tier application with web, application, and database layers. Why should you assign different security groups to each layer?

A To control traffic flow precisely between layers and limit exposure if one layer is compromised.

B To reduce AWS costs by minimizing the number of security groups used.

C To allow all traffic between layers without restrictions for easier management.

D To enable automatic scaling of security groups with the number of instances.

💡 Hint

Think about how fences between rooms help contain problems.

Using separate security groups lets you restrict traffic between layers, improving security by limiting access and reducing risk if one layer is attacked.