Instiq
Chapter 6 · Network Security, Compliance, and Governance·v2.0.0·Updated 7/16/2026·~11 min

What's changed: Deepened ANS-C01 Chapter 6 (SG/NACL eval order/SG references/ephemeral, inspection VPC routing/appliance mode/firewall remits, Shield Adv/WAF Web ACL/Firewall Mgr prereqs/ACM Region + tables, scenarios, FAQ, traps; ja figures)

6.1Defense in Depth and Traffic Control

Key points

Defend in layers—understand security groups (stateful), NACLs (stateless), defense in depth, and least-privilege networking. Protect at every layer.

Network security is built on defense in depth. Protect at the edge, subnet, instance, and app/data layers so that if one is breached, the next holds.

6.1.1Layers of defense

Diagram of layered network defense: the edge layer is CloudFront + WAF + Shield (L7 filtering and DDoS protection), the subnet layer is NACL (stateless, coarse allow/deny), the instance layer is a security group (stateful, per-ENI), and the app/data layer is IAM, TLS, and encryption—protecting across multiple layers from edge → subnet → instance → app/data.
Layered network defense
  • Security group: per instance (ENI), stateful. Allow rules only (no explicit deny).
  • NACL: per subnet, stateless. Supports allow and deny; good for coarse boundary control.
  • Defense in depth: layer edge (WAF/Shield) → subnet (NACL) → instance (SG) → data (encryption).
  • Least privilege: allow only the needed sources/ports; avoid broad 0.0.0.0/0 allows.
Exam point

Common on ANS-C01: SG = per-instance, stateful, allow-only, NACL = per-subnet, stateless, allow/deny, and block a specific IP = NACL (SGs cannot write deny rules). "Block just one IP" is a job for NACLs.

Continue reading — free sign-up

You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.

Get started freeLog in