NACLs & Security Groups

Question 1

True or false: NACLs are stateless.

Answer 1

True

Question 2

True or false: Security groups are stateful.

Answer 2

True

Question 3

True or false: Security groups are placed directly behind the internet gateway (IGW).

Answer 3

False, they are attached to vpcs. NACLs are placed directly behind the IGW.

Question 4

What is the ephemeral port range?

Answer 4

1024 - 65535

Question 5

Is there an implicit deny in NACLs?

Answer 5

Yes, it’s denoted by an *.

Question 6

The default VPC will have two NACL rules. What are they?

Answer 6

The two rules are in the following order:
1) All traffic is allowed within the vpc.
2) Implicit deny.

Question 7

True or false: NACLs work just like ACLs on router and switches.

Answer 7

True

Question 8

True or false: NACLs only affect traffic between different subnets.

Answer 8

True

Question 9

True or false: NACLs and Security Groups are typically used together.

Answer 9

True

Question 10

True or false: In most designs, NACLs are used to deny traffic, and Security Groups are used to allow traffic.

Answer 10

True

Question 11

How many NACLs can be associated with one vpc?

Answer 11

Only one NACL

Question 12

At what OSI layer does security groups operate?

Answer 12

Layer 7

Question 13

If you want to block a single client ip, which would work: NACL or Security Group?

Answer 13

NACL

Question 14

If NACLs are attached to subnets, what are Security Groups attached to?

Answer 14

ENIs - elastic network interfaces

Question 15

Security Groups are used to allow access to what? Give examples.

Answer 15

VPC based resources
- EC2 instances
- Lambda
- Variety other AWS services within a VPC

Question 16

What are the two things that Security Groups can reference if permitting traffic?

Answer 16

1) CIDR, protocol, and ports
2) Security group ID

Question 17

Can one security group reference another security group?

Answer 17

Yes, it uses the security group’s id.

Question 18

True or false: Security groups in once vpc can reference another security in another vpc.

Answer 18

True

Question 19

True or false: security groups block inbound traffic by default.

Answer 19

True

Question 20

True or false: security groups block all outbound traffic by default.

Answer 20

False, all outbound traffic is permitted by default.

Question 21

What is a Security Group attached to?

Answer 21

An ENI

Question 22

When bringing up a secondary ENI on a VPC, how many Security Groups can be attached?

Answer 22

Only one can be attached to an ENI.