Cloud network security groups in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the primary function of security groups

What is the main purpose of a cloud network security group?

A To manage cloud resource billing and cost allocation

B To store data backups securely in the cloud

C To monitor user activity logs for compliance

D To control inbound and outbound traffic to cloud resources based on rules

💡 Hint

Think about how cloud resources are protected from unwanted network access.

Security groups act like virtual firewalls that control what network traffic can reach or leave cloud resources by applying rules.

📋 Factual

intermediate

Default behavior of security groups

What is the default behavior of a newly created cloud security group regarding inbound traffic?

A All inbound traffic is denied by default

B All inbound traffic is allowed by default

C Inbound traffic is allowed only from the same security group

D Inbound traffic is allowed only from trusted IP addresses

💡 Hint

Consider the principle of least privilege in security.

By default, security groups deny all inbound traffic to protect resources until explicit rules allow specific traffic.

🔍 Analysis

advanced

Effect of overlapping security group rules

If a cloud resource is associated with two security groups where one allows inbound HTTP (port 80) from any IP and the other denies all inbound traffic, what will be the effective inbound HTTP access?

A Inbound HTTP traffic will be allowed only from specific IPs

B Inbound HTTP traffic will be denied due to the deny rule

C Inbound HTTP traffic will be allowed from any IP

D Inbound HTTP traffic will be blocked unless explicitly allowed in both groups

💡 Hint

Remember how security groups handle allow and deny rules.

Security groups typically use an implicit deny for traffic not allowed. However, they do not have explicit deny rules; if any associated group allows traffic, it is permitted.

❓ Comparison

advanced

Difference between security groups and network ACLs

Which statement correctly distinguishes cloud security groups from network ACLs (Access Control Lists)?

A Both security groups and network ACLs are stateful and operate at the instance level

B Security groups operate at the instance level and are stateful; network ACLs operate at the subnet level and are stateless

C Security groups operate at the subnet level and are stateless; network ACLs operate at the instance level and are stateful

D Both security groups and network ACLs are stateless and operate at the subnet level

💡 Hint

Think about where each applies and how they track connections.

Security groups are stateful and control traffic at the instance level, remembering allowed connections. Network ACLs are stateless, apply to subnets, and require explicit rules for both inbound and outbound traffic.

❓ Reasoning

expert

Diagnosing connectivity issues with security groups

A user reports that their cloud virtual machine cannot receive SSH connections (port 22) from their office IP, even though a security group rule allows inbound SSH from that IP. Which is the most likely cause?

A The network ACL associated with the subnet blocks inbound SSH traffic

B The security group rule is set to allow outbound SSH instead of inbound

C The virtual machine's firewall is blocking SSH connections

D The security group is missing an outbound rule allowing return traffic

💡 Hint

Consider other network controls besides security groups that affect traffic.

Even if the security group allows inbound SSH, a network ACL blocking inbound port 22 traffic at the subnet level will prevent connections. Network ACLs are stateless and require explicit allow rules.

Practice

1. What is the primary purpose of a cloud network security group?

easy

A. To store data securely in the cloud

B. To monitor user activity on cloud applications

C. To control inbound and outbound traffic to cloud resources

D. To manage cloud billing and costs

Solution

1. Step 1: Understand the role of security groups

   Security groups act like virtual firewalls that control network traffic to and from cloud resources.

2. Step 2: Identify the main function

   The main function is to allow or block traffic based on rules for inbound and outbound connections.

3. Final Answer:

   To control inbound and outbound traffic to cloud resources -> Option C

4. Quick Check:

   Security groups control traffic = B [OK]

Hint: Security groups control traffic flow to cloud resources [OK]

Common Mistakes:

• Confusing security groups with data storage
• Thinking security groups manage billing
• Assuming security groups monitor user activity

2. Which of the following is the correct way to specify a rule in a cloud network security group?

easy

A. Allow inbound TCP traffic on port 80 from any IP address

B. Block outbound UDP traffic on port 22 from all IPs

C. Enable all traffic without restrictions

D. Allow inbound traffic only on port 443 without specifying protocol

Solution

1. Step 1: Review rule components

   A security group rule must specify direction (inbound/outbound), protocol (TCP/UDP), port, and source/destination.

2. Step 2: Check each option

   Allow inbound TCP traffic on port 80 from any IP address correctly specifies inbound TCP traffic on port 80 from any IP. Block outbound UDP traffic on port 22 from all IPs incorrectly blocks outbound UDP on port 22 (usually SSH uses TCP). Enable all traffic without restrictions is insecure. Allow inbound traffic only on port 443 without specifying protocol misses protocol specification.

3. Final Answer:

   Allow inbound TCP traffic on port 80 from any IP address -> Option A

4. Quick Check:

   Complete rule details = D [OK]

Hint: Rules need direction, protocol, port, and source/destination [OK]

Common Mistakes:

• Omitting protocol in rules
• Allowing all traffic without restrictions
• Confusing inbound and outbound directions

3. Consider this security group rule: Allow inbound TCP traffic on port 22 from IP 192.168.1.0/24. What does this rule do?

medium

A. Blocks all inbound traffic except from 192.168.1.0/24

B. Allows SSH access only from IP addresses in the 192.168.1.0 to 192.168.1.255 range

C. Allows all inbound TCP traffic on port 22 from any IP

D. Allows outbound TCP traffic on port 22 to 192.168.1.0/24

Solution

1. Step 1: Analyze the rule components

   The rule allows inbound TCP traffic on port 22, which is commonly used for SSH, from the IP range 192.168.1.0/24.

2. Step 2: Interpret the IP range and direction

   The /24 means all IPs from 192.168.1.0 to 192.168.1.255 are allowed inbound access on port 22.

3. Final Answer:

   Allows SSH access only from IP addresses in the 192.168.1.0 to 192.168.1.255 range -> Option B

4. Quick Check:

   Inbound TCP port 22 from 192.168.1.0/24 = A [OK]

Hint: CIDR /24 means IP range from .0 to .255 [OK]

Common Mistakes:

• Confusing inbound with outbound traffic
• Assuming the rule blocks traffic
• Ignoring the IP range mask meaning

4. A security group rule is written as: Allow inbound UDP traffic on port 80 from 0.0.0.0/0. What is wrong with this rule?

medium

A. Port 80 usually uses TCP, not UDP, so the rule may not work as intended

B. The IP range 0.0.0.0/0 is invalid and blocks all traffic

C. Inbound direction should be outbound for port 80

D. The rule is correct and needs no changes

Solution

1. Step 1: Check protocol and port pairing

   Port 80 is typically used for HTTP traffic, which uses TCP, not UDP.

2. Step 2: Evaluate the impact of protocol mismatch

   Using UDP on port 80 may cause the rule to allow traffic that is not expected or block legitimate HTTP traffic.

3. Final Answer:

   Port 80 usually uses TCP, not UDP, so the rule may not work as intended -> Option A

4. Quick Check:

   Protocol-port mismatch = C [OK]

Hint: Match protocol to common port usage (e.g., TCP for port 80) [OK]

Common Mistakes:

• Thinking 0.0.0.0/0 is invalid
• Confusing inbound and outbound directions
• Assuming UDP works on all ports

5. You want to secure a cloud server so it only accepts web traffic (HTTP and HTTPS) from a specific office IP range 203.0.113.0/24. Which set of security group rules should you apply?

hard

A. Allow all inbound traffic from 203.0.113.0/24; block outbound traffic

B. Allow inbound UDP traffic on ports 80 and 443 from 0.0.0.0/0; allow all outbound traffic

C. Allow inbound TCP traffic on port 22 from 203.0.113.0/24; allow inbound TCP on port 80 from any IP

D. Allow inbound TCP traffic on ports 80 and 443 from 203.0.113.0/24; deny all other inbound traffic

Solution

1. Step 1: Identify required traffic types and sources

   Web traffic uses TCP ports 80 (HTTP) and 443 (HTTPS). The source must be limited to 203.0.113.0/24.

2. Step 2: Choose rules that allow only this traffic and block others

   Allow inbound TCP traffic on ports 80 and 443 from 203.0.113.0/24; deny all other inbound traffic allows inbound TCP on ports 80 and 443 from the specified IP range and denies other inbound traffic, securing the server properly.

3. Final Answer:

   Allow inbound TCP traffic on ports 80 and 443 from 203.0.113.0/24; deny all other inbound traffic -> Option D

4. Quick Check:

   Restrict web ports and source IP = A [OK]

Hint: Allow only needed ports and source IPs for tight security [OK]

Common Mistakes:

• Allowing all IPs instead of restricting source
• Using wrong protocols (UDP instead of TCP)
• Allowing unnecessary ports like SSH