Security Group Flashcards
With security groups all traffic is blocked or allowed by default?
Blocked
Each Security Group contains a set of rules that filter traffic coming into (inbound) and out of (outbound) EC2 instances.
What is the purpose of a security group?
To act as a virtual firewall at the instance level
Multiple Instances across multiple subnets can belong to a Security Group.
How can you use Security groups and subnets?
Multiple Instances across multiple subnets can belong to a Security Group.
Subnet 1 with a EC2
Subnet 2 with a EC2
Subnet 3 with a EC2
All of those EC2’s share the same Security Group
Security Groups and subnets Three Use Cases
2 Subnets with 2 Security Groups
One Security Group allows traffic From an IP
(The instance in the other Subnet)
2 Subnets with 2 Security Groups
One Security Group allows traffic From the other Security Group
(The Security Group In the other Subnet)
2 Subnets that have the same Security Group, inside one Subnet, In that Security Group there is another Security Group but in one Subnet that allows everything, but the first Subnet doesn’t Allow Everything
With security groups all traffic is allowed or denied by default
denied
In ELB,
What is the maximum number of security groups you can have in a region?
10.000
In ELB,
What is the maximum number of inbound / outbound rules on each security group?
- 60 Inbound Rules
- 60 Outbound Rules
In ELB, You cannot block specific IP addresses with Security Groups, for this you would need a…
Network Access Control List (NACL)
How many security groups there can be associated to an ENI?
And the default!
You can have 16 Security Groups associated to an ENI (default is 5)
Security Groups are STATEFUL, what does it mean?
if traffic is allowed inbound it is also allowed outbound
You can block this with a NACL, but not with a Security Group
A single IP address
You can allow or deny traffic. You could block a single IP address (You can’t do this with Security Groups)
How many NACLs can a Subnet be associated with?
1
Subnets are associated with NACLs. Subnets can only belong to a single NACL.
In NACLs, Which of the following rule #s would be evaluated first?
99, 11, 10, 1, 75
1
Rule # determines the order of evaluation. From lowest to highest. The highest rule # can be 32766 and its recommended to work in 10 or 100 increments.
What is a NACL
It’s an optional layer security that acts as a Firewall for controlling traffic in and out of subnets
NACLs acts as a virtual firewall at the subnet level
If you want to prevent SSH access into your instances and you don’t have any configuration in your Security Group, where can you Deny SSH (PORT 22)?
NACLs
Security Groups cannot deny
