Security group quiz · Level 0 · Todo.io Learns AWS

Question 1Only Todo.io's app servers may connect to the MySQL database on port 3306. The app servers come and go during the day, so their private IP addresses keep changing. How should the database's security group allow them in?

Allow inbound TCP 3306 with the app servers' security group as the source.Correct. A security group rule can name another security group as its source: anything wearing that group may connect, whatever its IP. It follows the servers as they come and go.Allow inbound TCP 3306 from each app server's private IP address.Not this one. This breaks every time a server is replaced, because the new one gets a different IP.Allow inbound TCP 3306 from the whole VPC's address range.Not this one. It works, but anything in the VPC could then reach the database. Least privilege means only the app servers.Allow inbound TCP 3306 from 0.0.0.0/0, since the database is in a private subnet anyway.Not this one. The subnet isn't a filter for traffic from inside the VPC. Defence in depth means the security group should still allow only what needs in.

Learn it: Security group

Question 2A security group on Todo.io's app server allows inbound HTTPS (TCP 443) from anywhere. Someone deletes all of its outbound rules. What happens to the replies the server sends to users' HTTPS requests?

They still get out. Security groups are stateful, so the reply to an allowed request is allowed automatically.Correct. Security groups remember the connections they let in, and let their replies out. Outbound rules only matter for connections the server starts itself.They are blocked until an outbound rule for TCP 443 is added.Not this one. That's how it would work if security groups were stateless. They aren't.They are blocked until an outbound rule for ports 1024–65535 is added.Not this one. That's the fix for a stateless firewall (network ACLs, Level 1). Security groups don't need it.They need a NAT gateway to leave the subnet.Not this one. A NAT gateway lets private resources start connections out. Replies to requests that came in through the internet gateway go back the same way.

Learn it: Security group

Question 3Todo.io wants to block one abusive IP address from reaching its web server, while still allowing everyone else. Can it add that block to the server's security group?

No. Security groups only have allow rules, so a security group can't block one address.Correct. Security groups have no deny rules. A stateless network ACL, which has both, comes in Level 1.Yes, with a deny rule for that address.Not this one. Security groups have no deny rules.Yes, with a lower rule number so it is checked first.Not this one. Security group rules have no numbers or order; every allow is checked together.Yes, by removing the outbound rules.Not this one. Replies to allowed traffic go out anyway: security groups are stateful.

Learn it: Security group

Question 4What does a security group attach to?

A network interface (ENI): the one on an EC2 instance, a Fargate task or a VPC-attached Lambda function.Correct. Security groups filter traffic at the network card, not at the subnet.A subnet.Not this one. Subnets don't take security groups. (Network ACLs attach to subnets, in Level 1.)The whole VPC.Not this one. Each network interface has its own security groups.A route table.Not this one. Route tables decide where traffic goes. They hold no rules about who may connect.

Learn it: ENI (Elastic Network Interface) · Security group

Question 5Where should Todo.io place its MySQL database inside the VPC?

In a private subnet, with a security group that only lets the app servers in.Correct. With no route to the internet gateway, nothing on the internet can even try to connect. The security group then narrows it to the app.In a public subnet, with a public IP, so the app can find it.Not this one. The app reaches it by private IP. A public IP only adds exposure.In a public subnet with no security group.Not this one. Every network interface has a security group, and a database should never face the internet.Outside the VPC, on the internet.Not this one. RDS databases always run inside a VPC.

Learn it: Subnet · Security group

Question 6Todo.io's web server is in a public subnet and has a public IP, but users get a timeout on HTTPS (port 443). What should be checked first?

That the instance's security group allows inbound TCP 443.Correct. Security groups deny everything that isn't allowed. A missing inbound rule shows up as a timeout.That there is a NAT gateway.Not this one. NAT is for calling out from private subnets, not for being reached.That there is an outbound rule for the replies.Not this one. Security groups are stateful; replies are allowed automatically.That the instance is in a private subnet.Not this one. A private subnet would make it unreachable from the internet.

Learn it: Security group

Question 7Todo.io's app can't connect to its RDS MySQL database: the connection times out. The password is correct. What is the most likely cause?

The database's security group doesn't allow inbound TCP 3306 from the app.Correct. A silent timeout is what a security group does with traffic it doesn't allow.The app's IAM role lacks permission to run SQL.Not this one. Connections to MySQL on RDS use a database username and password, and a wrong one is refused, not timed out.CloudTrail is blocking the connection.Not this one. CloudTrail only records; it never blocks.The database needs a public IP.Not this one. The app is in the same VPC and uses the private IP.

Learn it: Security group · RDS (Relational Database Service)

Question 8A Lambda function that isn't attached to a VPC writes to DynamoDB. Which security group is involved?

None. With no VPC there are no security groups, and DynamoDB has none either; IAM decides.Correct. Security groups only exist on network interfaces in a VPC.The VPC's default security group.Not this one. The function isn't in the VPC.The DynamoDB table's security group.Not this one. Tables have no security groups.The NAT gateway's security group.Not this one. There is no NAT gateway on this path, and NAT gateways don't take security groups.

Learn it: DynamoDB · Security group

Question 9What does "Security group" mean?

A firewall attached to a network card, listing what traffic is allowed in and out.Correct. Think of it as: A bouncer standing at one particular door, holding a guest list.An address the whole internet can reach.Not this one. That describes Public IP address.A virtual network card that gives something an address in a subnet.Not this one. That describes ENI (Elastic Network Interface).The VPC's door to the public internet.Not this one. That describes Internet gateway.

Learn it: Security group

Question 10Which term is this? "A firewall attached to a network card, listing what traffic is allowed in and out."

Security groupCorrect. Yes. Think of it as: A bouncer standing at one particular door, holding a guest list.Public IP addressNot this one. Public IP address is: An address the whole internet can reach.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.

Learn it: Security group

Question 11Which AWS term is described by this analogy? "A bouncer standing at one particular door, holding a guest list."

Security groupCorrect. Yes: A firewall attached to a network card, listing what traffic is allowed in and out.Public IP addressNot this one. Public IP address is: An address the whole internet can reach. Its analogy: A street address printed on the outside of the building.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet. Its analogy: A phone line installed in a particular room.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.

Learn it: Security group

Security group

Worth another look

Your weak spots

Services

Concepts