Amazon VPC provides multiple layers of network security.
| Feature | Security Groups | Network ACLs |
|---|---|---|
| Level | Instance (ENI) | Subnet |
| State | Stateful | Stateless |
| Rules | Allow only | Allow and Deny |
| Default | Deny inbound, allow outbound | Allow all (default NACL) |
| Evaluation | All rules evaluated | Rules evaluated in order |
Allow instances in private subnets to access the internet while remaining unreachable from the internet.
Create a VPC with public and private subnets, configure security groups and NACLs, and verify network isolation.
25 minutes
Step 1: Create a VPC
VPC_ID=$(aws ec2 create-vpc \
--cidr-block 10.0.0.0/16 \
--tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=StudyVPC}]' \
--query 'Vpc.VpcId' --output text)
echo "VPC ID: $VPC_ID"
Step 2: Create public and private subnets
PUBLIC_SUBNET=$(aws ec2 create-subnet \
--vpc-id $VPC_ID \
--cidr-block 10.0.1.0/24 \
--availability-zone us-east-1a \
--tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=PublicSubnet}]' \
--query 'Subnet.SubnetId' --output text)
PRIVATE_SUBNET=$(aws ec2 create-subnet \
--vpc-id $VPC_ID \
--cidr-block 10.0.2.0/24 \
--availability-zone us-east-1a \
--tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=PrivateSubnet}]' \
--query 'Subnet.SubnetId' --output text)
Step 3: Create and attach an Internet Gateway
IGW_ID=$(aws ec2 create-internet-gateway \
--query 'InternetGateway.InternetGatewayId' --output text)
aws ec2 attach-internet-gateway --internet-gateway-id $IGW_ID --vpc-id $VPC_ID
Step 4: Create a route table for the public subnet
PUBLIC_RT=$(aws ec2 create-route-table \
--vpc-id $VPC_ID \
--query 'RouteTable.RouteTableId' --output text)
aws ec2 create-route --route-table-id $PUBLIC_RT \
--destination-cidr-block 0.0.0.0/0 --gateway-id $IGW_ID
aws ec2 associate-route-table --route-table-id $PUBLIC_RT --subnet-id $PUBLIC_SUBNET
Step 5: Create a security group for web servers
WEB_SG=$(aws ec2 create-security-group \
--group-name WebServerSG \
--description "Allow HTTP and HTTPS" \
--vpc-id $VPC_ID \
--query 'GroupId' --output text)
aws ec2 authorize-security-group-ingress --group-id $WEB_SG \
--protocol tcp --port 80 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --group-id $WEB_SG \
--protocol tcp --port 443 --cidr 0.0.0.0/0
aws ec2 delete-security-group --group-id $WEB_SG
aws ec2 delete-subnet --subnet-id $PUBLIC_SUBNET
aws ec2 delete-subnet --subnet-id $PRIVATE_SUBNET
aws ec2 detach-internet-gateway --internet-gateway-id $IGW_ID --vpc-id $VPC_ID
aws ec2 delete-internet-gateway --internet-gateway-id $IGW_ID
aws ec2 delete-route-table --route-table-id $PUBLIC_RT
aws ec2 delete-vpc --vpc-id $VPC_ID
| # | Question | Answer |
|---|---|---|
| 1 | Are Security Groups stateful or stateless? | Stateful — return traffic is automatically allowed |
| 2 | Are NACLs stateful or stateless? | Stateless — return traffic must be explicitly allowed |
| 3 | What is the default behavior of a custom NACL? | Denies all inbound and outbound traffic |
| 4 | Can Security Groups have deny rules? | No, Security Groups only support allow rules |
| 5 | What is the difference between Shield Standard and Shield Advanced? | Standard is free (Layer 3/4 DDoS). Advanced is $3K/month with DRT, cost protection, and enhanced detection. |
| 6 | Where can AWS WAF be deployed? | CloudFront, ALB, API Gateway, AppSync |
| 7 | What does Amazon GuardDuty analyze? | CloudTrail logs, VPC Flow Logs, DNS logs, S3 data events, EKS audit logs |
| 8 | What is the difference between Cognito User Pools and Identity Pools? | User Pools handle authentication (sign-up/sign-in). Identity Pools provide temporary AWS credentials for authorization. |
| 9 | Is Direct Connect encrypted by default? | No. Add VPN over Direct Connect for encryption. |
| 10 | What does Amazon Macie detect? | Sensitive data in S3 (PII, financial data, credentials) using machine learning |
A company needs to protect its web application from SQL injection and cross-site scripting attacks. The application is served through an Application Load Balancer. Which AWS service should the solutions architect recommend?
Correct: C
AWS WAF protects against Layer 7 attacks including SQL injection and XSS. It can be deployed directly on an ALB. Shield Standard protects against DDoS (Layer 3/4), not application-layer attacks. GuardDuty is a threat detection service, not a firewall. Security Groups do not support deny rules or application-layer filtering.
Domain: 1 — Design Secure Architectures Task: 1.2
A solutions architect is designing a VPC for a three-tier web application. The database tier must not be accessible from the internet. Which configuration achieves this?
Correct: B
Placing the database in a private subnet (no route to IGW) ensures it cannot be reached from the internet. This is the standard network segmentation pattern. Options A, C, and D all place the database in a public subnet, which is not a best practice even with additional controls.
Domain: 1 — Design Secure Architectures Task: 1.2
A company stores database credentials in application configuration files on EC2 instances. The security team wants to centralize credential management with automatic rotation. Which service should be used?
Correct: B
AWS Secrets Manager is designed for storing and automatically rotating secrets like database credentials. It integrates natively with RDS, Redshift, and DocumentDB for automatic rotation. Parameter Store can store secrets but does not have built-in rotation. KMS manages encryption keys, not credentials. S3 is not designed for credential management.
Domain: 1 — Design Secure Architectures Task: 1.2
A company needs a dedicated, private network connection from their on-premises data center to AWS with consistent performance. The connection must also be encrypted. What should the solutions architect recommend?
Correct: C
Direct Connect provides a dedicated private connection with consistent performance, but it is not encrypted by default. Adding a VPN connection over Direct Connect provides both the dedicated bandwidth and encryption. VPN alone goes over the public internet (inconsistent performance). Client VPN is for remote user access, not site-to-site connectivity.
Domain: 1 — Design Secure Architectures Task: 1.2
A company wants to detect if any of their S3 buckets contain personally identifiable information (PII). Which AWS service should they use?
Correct: C
Amazon Macie uses machine learning to discover, classify, and protect sensitive data in S3, including PII. GuardDuty detects threats but does not classify data content. Inspector assesses EC2 and container vulnerabilities. Config tracks resource configuration changes.
Domain: 1 — Design Secure Architectures Task: 1.2