AWS Solutions Architect Associate (SAA-C02) Exam Prep Course - 2021 UPDATED! - Working with Security Groups

The video tutorial delves into the concept of security groups, comparing them to firewalls and explaining their role in managing network traffic at the instance level. It highlights the limitations of security groups, such as the maximum number per instance and their default settings. The tutorial contrasts security groups with network ACLs, emphasizing their stateful nature and the differences in rule application. It also covers the constraints and configurations of security groups, including their application to network interfaces. The video concludes with a summary of key points and exam preparation tips.

What is the maximum number of security groups that can be attached to a single instance?

• 3

• 10

• 5

• 7

Which of the following is true about the default security group in a VPC?

• It is automatically assigned to instances.

• It allows all inbound traffic by default.

• It cannot be modified.

• It cannot be detached.

How do security groups differ from network ACLs in terms of rule support?

• Network ACLs support only deny rules.

• Security groups support only allow rules.

• Network ACLs support only allow rules.

• Security groups support both allow and deny rules.

What is a key characteristic of security groups that makes them different from network ACLs?

• They are stateless.

• They support deny rules.

• They are stateful.

• They apply to subnets.

In a VPC, where are network ACLs applied?

• To subnets

• To network interfaces

• To individual instances

• To security groups

What is the role of an Internet gateway in a VPC?

• To allow instances to connect to the Internet

• To block all incoming traffic

• To provide DNS services

• To manage security groups

Which statement is true about the stateful nature of security groups?

• They block all inbound traffic by default.

• They automatically allow responses to outbound requests.

• They require explicit rules for inbound traffic.

• They require explicit rules for outbound traffic.

What is a constraint of security groups regarding network interfaces?

• They must be bound to all network interfaces.

• They cannot be bound to elastic network interfaces.

• They can only be bound to primary network interfaces by default.

• They can only be bound to secondary network interfaces.

How can security groups be applied to instances?

• Only when specified during instance launch or later

• Automatically to all instances in a subnet

• By default to all instances in a VPC

• Only to instances with a public IP

What is a potential use case for having different security groups on different network interfaces of the same instance?

• To allow all interfaces to communicate with the Internet

• To restrict all interfaces from communicating with the Internet

• To have one interface open to the Internet and another restricted

• To apply the same rules to all interfaces