Skip to content

3 · Network & Infrastructure Security — Revise

Security · 30% · Compressed recall. Read the Learn guide first.

Security Group vs NACL

Security Group Network ACL
Level Instance / ENI Subnet
State Stateful (return auto-allowed) Stateless (return needs a rule)
Rules Allow only Allow + Deny
Order All evaluated Numbered, lowest first, first match wins
Default Deny in / allow out Default NACL allow all; custom NACL deny all
Deny an IP? ❌ can't ✅ use this
Return traffic Automatic Allow ephemeral 1024–65535 outbound

Service → purpose

Service Purpose
WAF L7 HTTP filtering: SQLi, XSS, rate-based, geo, IP sets (CloudFront/ALB/API GW)
Shield Standard Free automatic L3/L4 DDoS
Shield Advanced Paid: enhanced DDoS + 24/7 team + cost protection + SLA
GuardDuty Threat detection (CloudTrail/Flow Logs/DNS, ML, agentless)
Inspector Vulnerability scan (EC2, ECR images, Lambda; CVEs)
Macie PII / sensitive data discovery in S3
Security Hub Aggregate findings + compliance (CIS/PCI) across accounts
Network Firewall Managed stateful VPC traffic filtering (IDS/IPS, domain)
Firewall Manager Central WAF/Shield/SG management across an Org
Detective Root-cause investigation of findings

Decision cues

Deny one IP at subnet?            → NACL deny rule
Allow instance-to-instance?       → Security Group (reference SG as source)
Block a country from web app?     → WAF geo-match / CloudFront geo-restriction
SQLi / XSS / rate-limit web app?  → WAF (on CloudFront/ALB/API GW)
DDoS + cost protection + SLA?     → Shield Advanced
Detect compromised creds/mining?  → GuardDuty
Scan for CVEs/vulnerabilities?    → Inspector
Find PII in S3?                   → Macie
One dashboard across accounts?    → Security Hub
Private outbound to internet?     → NAT Gateway (bills hourly + per GB)
Reach S3/DynamoDB privately?      → VPC Gateway endpoint (Interface/PrivateLink for others)

Flashcards

Which firewall is stateful, and what does that mean? Security Group. Return traffic for an allowed inbound flow is automatically permitted — no matching outbound rule needed.
NACL allows inbound + outbound 443 but connections hang. Fix? NACLs are stateless — allow outbound ephemeral ports 1024–65535 for the return traffic.
How do you block a single malicious IP for a whole subnet? A NACL deny rule (Security Groups can't deny).
GuardDuty vs Inspector vs Macie? GuardDuty = threats/anomalies from logs; Inspector = software vulnerabilities/CVEs; Macie = PII in S3.
Does GuardDuty block attacks? No — it detects and alerts. Blocking is WAF/Shield/NACL/SG.
What does Security Hub actually do? Aggregates findings from GuardDuty/Inspector/Macie/etc. and runs compliance checks across accounts. It doesn't detect on its own.
Shield Standard vs Advanced? Standard = free, automatic L3/L4 DDoS. Advanced = paid, adds response team, SLA, and DDoS-related cost protection; also brings WAF.
WAF attaches to what? CloudFront, ALB, API Gateway, AppSync, Cognito — Layer 7. Not raw EC2 or a subnet.
Reach S3 privately from a VPC without internet? VPC Gateway endpoint for S3/DynamoDB (Interface endpoints/PrivateLink for most other services).

Common traps

  • SG stateful/allow-only; NACL stateless/allow+deny — the #1 tested distinction.
  • Deny an IP → NACL, not Security Group.
  • NACL return traffic → ephemeral ports 1024–65535 outbound.
  • Custom NACL denies all until you add rules.
  • GuardDuty detects, Security Hub aggregates — neither blocks.
  • Inspector ≠ Macie ≠ GuardDuty (CVEs vs PII vs threats).
  • WAF = Layer 7; Shield = DDoS (L3/L4).