What's changed: Deepened ANS-C01 Chapter 6 (SG/NACL eval order/SG references/ephemeral, inspection VPC routing/appliance mode/firewall remits, Shield Adv/WAF Web ACL/Firewall Mgr prereqs/ACM Region + tables, scenarios, FAQ, traps; ja figures)
6.1Defense in Depth and Traffic Control
Defend in layers—understand security groups (stateful), NACLs (stateless), defense in depth, and least-privilege networking. Protect at every layer.
Network security is built on defense in depth. Protect at the edge, subnet, instance, and app/data layers so that if one is breached, the next holds.
6.1.1Layers of defense
- Security group: per instance (ENI), stateful. Allow rules only (no explicit deny).
- NACL: per subnet, stateless. Supports allow and deny; good for coarse boundary control.
- Defense in depth: layer edge (WAF/Shield) → subnet (NACL) → instance (SG) → data (encryption).
- Least privilege: allow only the needed sources/ports; avoid broad 0.0.0.0/0 allows.
Common on ANS-C01: SG = per-instance, stateful, allow-only, NACL = per-subnet, stateless, allow/deny, and block a specific IP = NACL (SGs cannot write deny rules). "Block just one IP" is a job for NACLs.
ANS-C01 tests evaluation order, scale limits, and SG-reference nuances. SGs and NACLs are evaluated independently, and traffic must pass both. A NACL is evaluated in rule-number order (lowest first) and decided by the first match, so number design matters—put a narrow deny before a broad allow—and being stateless, it must also explicitly allow the ephemeral port range (1024–65535) for return traffic. In an SG you can reference another SG as the source (e.g., allow the ALB’s SG) instead of just IP/CIDR, giving a scalable design where you needn’t rewrite IPs as instances scale. SGs are stateful so returns are auto-allowed, but connection tracking has limits and extreme connection counts can become "untracked." Limit awareness matters too: SGs have default caps on SGs-per-ENI and rules, and consolidating references via prefix lists eases management. Each defense layer has a distinct role—WAF for L7 attacks, NACL for coarse subnet-boundary blocking, SG for per-workload least privilege—layered where each fits best.
| Aspect | Security group | NACL |
|---|---|---|
| Scope | ENI (instance) | Subnet |
| State | Stateful (return auto) | Stateless (both directions) |
| Rules | Allow only | Allow and deny |
| Evaluation | Union of all rules (no order) | By number, first match wins |
| Source reference | Can reference another SG | IP/CIDR only |
Scenario: a 3-tier web app (ALB→app→DB) where the app accepts only from the ALB and the DB only from the app, and you don’t want to edit config as instances scale and IPs change. → On each tier’s SG, reference the lower tier’s SG as the source (allow the ALB SG inbound to the app SG, and the app SG inbound to the DB SG). Using SG references instead of IPs follows scaling and keeps least privilege.
FAQ: Q. Deny a specific IP in an SG? A. You can’t (allow-only)—use a NACL to deny at the subnet boundary. Q. Tightening the NACL broke returns? A. Being stateless, you likely didn’t allow the ephemeral return ports (1024–65535) out/in. Q. SG reference or IP allow? A. For scaling workloads, SG references are easier to maintain.
Trap: "since the SG allows it, the NACL doesn’t matter" is false—they are evaluated independently and either denying blocks the flow. Conversely, "loosen the NACL and you needn’t loosen the SG" is also wrong. And because NACLs are stateless, you must explicitly allow the return (ephemeral ports), not just the forward direction—a classic pitfall.
6.1.2Section summary
- SG = ENI, stateful, allow-only / NACL = subnet, stateless, allow/deny
- Defend in layers; allow with least privilege
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Explicitly block access from a specific malicious IP across an entire subnet. What?
Q2. Which is correct about security groups?
Q3. Which is the most appropriate network security design principle?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.