3.2 - Design internal network security controls (security groups, NACLs, endpoints, Flow Logs, Reachability Analyzer)

1. You create a brand new network ACL and associate it with a subnet, without writing any rule. What happens to the traffic of that subnet?

• Everything keeps flowing in both directions until the first rule is written, exactly like the default network ACL that comes with a freshly created VPC
• All inbound and outbound traffic is denied (correct answer)
• Only traffic between subnets of the same VPC keeps flowing
• The rules of the default network ACL are copied into the new one

A network ACL you create yourself starts with a single implicit deny in each direction, so associating it cuts the subnet off immediately. Only the default network ACL created with the VPC allows everything, nothing is copied from it into a new ACL, and there is no built in exception for intra VPC traffic.

2. You publish an internal service through AWS PrivateLink. Which setting decides which consumer accounts may create an endpoint towards it?

• The security group of the Network Load Balancer, whose inbound rules must list the private address ranges used by every consumer VPC that has been approved
• A resource policy attached to the Network Load Balancer itself
• The allowed principals list of the endpoint service (correct answer)
• An endpoint policy that the consumer attaches on its own side

The provider grants access by adding account, user or role ARNs to the allowed principals of the endpoint service, optionally with manual acceptance of each connection request. A load balancer takes no resource policy, consumer addresses are never visible to the provider because PrivateLink does not route between the VPCs, and an endpoint policy written by the consumer cannot grant it a right the provider withheld.

3. How do security groups and network ACLs differ inside a VPC?

• Both are stateless, so each direction of a flow has to be permitted by its own explicit rule on the way in and again on the way out
• Both are stateful and both accept deny rules, the only real difference being that one attaches to an instance and the other to a subnet
• A security group is stateful and allow only; a network ACL is stateless and also accepts deny (correct answer)
• A security group is evaluated after the network ACL for inbound traffic and before it for outbound traffic, which is why rule order matters

A security group is stateful, so the return traffic of an allowed flow is permitted automatically, and it can express allow rules only. A network ACL is stateless, evaluates inbound and outbound separately by rule number, and can deny explicitly. Neither is stateless on both sides, a security group never accepts a deny rule, and the two are not chained in a fixed order that depends on direction.

4. Instances in a subnet can open outbound HTTPS connections but every response is dropped. The security group allows all outbound traffic. What should you inspect first?

• The security group inbound rules, which must explicitly allow the response packets of any connection the instance itself opened
• The DNS resolver of the VPC, since a partial resolution failure normally shows up as responses that arrive but are silently discarded
• The instance's IAM role, whose policy has to permit the destination service before the network stack accepts the returning packets
• The network ACL inbound rules for the ephemeral port range (correct answer)

A network ACL is stateless, so the response of an outbound connection arrives on an ephemeral source port and needs its own inbound allow rule, typically 1024 to 65535. The security group needs nothing because it is stateful and already tracks the flow, DNS failures break name resolution rather than established sessions, and IAM never filters packets.

5. Instances in a private subnet must reach Amazon S3 without any traffic leaving the AWS network. Which endpoint type applies?

• An interface endpoint, which places an elastic network interface with a private address into each subnet you select
• A gateway endpoint, added as a route in the subnet route table (correct answer)
• A NAT gateway in the public subnet, paired with an internet gateway on the VPC and a default route out of the private subnet
• A Direct Connect virtual interface terminated on a virtual private gateway attached to the VPC that hosts the private subnet

S3 and DynamoDB are the two services served by gateway endpoints, which work through a route table prefix list and cost nothing. An interface endpoint is possible for S3 but is not the classic answer here and is billed per hour and per gigabyte, a NAT gateway would send the traffic over the public S3 endpoint, and Direct Connect connects an on premises site rather than isolating a subnet.

6. You want traffic leaving a VPC through an S3 gateway endpoint to reach only buckets that belong to your own organization. Where do you express that?

• In a VPC endpoint policy using aws:PrincipalOrgID or a bucket list (correct answer)
• In the security group attached to each instance, whose outbound rules must name the public address ranges published by S3 for the region
• In the subnet route table, by pointing the S3 prefix list at a more specific destination that covers only the buckets of the organization
• In an inbound network ACL rule on the private subnet, denying the address ranges of every S3 bucket that belongs to a foreign account

An endpoint policy is a resource policy evaluated on every request that transits the endpoint, so a condition on the organization id blocks copies to a stranger's bucket. Security groups and network ACLs only see addresses and cannot tell one bucket from another, and a route table chooses a path rather than a bucket.