Skip to content

CLF-C02 Study Notes: Task Statement 2.4

Identify Components and Resources for Security

Exam focus: Know the purpose and basic use cases of AWS security services. You are not expected to design or configure advanced security architectures.

1. Network Security Components

Security Groups

A security group is a virtual firewall that controls traffic for supported AWS resources.

  • Operates at the resource/network interface level, not at the subnet level.
  • Commonly associated with resources such as:
  • Amazon EC2 instances
  • Amazon RDS instances
  • Other resources that use Elastic Network Interfaces
  • Controls:
  • Inbound traffic
  • Outbound traffic
  • Is stateful:
  • If inbound traffic is allowed, the response traffic is automatically allowed outbound.
  • You do not need to create a separate rule for the return traffic.
  • Supports rules based on:
  • IP addresses
  • IP address ranges
  • Other security groups
  • Has an implicit deny:
  • Traffic that is not explicitly allowed is denied.
  • Cannot create explicit deny rules.

Example

If an EC2 instance allows inbound HTTPS traffic through its security group, the response traffic for that connection is automatically allowed back out, assuming the connection is permitted.

Network Access Control Lists (Network ACLs)

A network ACL (NACL) is a virtual firewall that controls traffic at the subnet level.

  • Associated with a subnet, not directly with individual resources.
  • Controls traffic entering or leaving a subnet.
  • Applies to traffic crossing the subnet boundary.
  • Is stateless:
  • Inbound and outbound traffic are evaluated independently.
  • If inbound traffic is allowed, a corresponding outbound rule is also required for return traffic.
  • Supports both:
  • Allow rules
  • Explicit deny rules
  • Rules are evaluated in numerical order, starting with the lowest rule number.
  • Can filter traffic based on IP addresses, protocols, and ports.

Example

If a client connects to an EC2 instance in a subnet:

  1. The NACL must allow the inbound request.
  2. The NACL must also allow the outbound response.
  3. A security group can allow the connection and automatically allow the response because it is stateful.

Important subnet behavior

If two EC2 instances communicate within the same subnet, their traffic does not cross the subnet boundary. Therefore, the subnet NACL does not control that communication in the same way it controls traffic entering or leaving the subnet. The instances’ security groups still apply.

Security Groups vs. Network ACLs

Feature Security Group Network ACL
Scope Resource or network interface Subnet
Traffic direction Inbound and outbound Inbound and outbound
Stateful? Yes No
Return traffic Automatically allowed Must be explicitly allowed
Allow rules Yes Yes
Explicit deny rules No Yes
Can reference another security group? Yes No
Common use Protect individual resources Add subnet-level network filtering
Default behavior Implicit deny for traffic not allowed Rules determine whether traffic is allowed or denied

Exam traps

  • “Explicitly deny traffic” → Network ACL
  • “Protect an EC2 instance” → Security group
  • “Protect or filter an entire subnet” → Network ACL
  • “Return traffic is automatically allowed” → Security group
  • “Inbound and outbound rules must both be configured” → Network ACL
  • Security groups are not subnet-level firewalls.
  • Network ACLs are not stateful.
  • Security groups cannot contain explicit deny rules.

2. AWS WAF

AWS WAF, or AWS Web Application Firewall, helps protect web applications by filtering HTTP and HTTPS traffic.

You can create rules based on conditions such as:

  • IP addresses or IP address ranges
  • HTTP headers
  • Request methods
  • Request strings
  • Custom URLs
  • Other web request characteristics

AWS WAF can help block common web attacks, including:

  • SQL injection
  • Cross-site scripting (XSS)
  • Malicious or unwanted web requests
  • Requests from specified IP addresses or locations

When to use AWS WAF

Use AWS WAF when the requirement involves:

  • Filtering web requests
  • Protecting an internet-facing web application
  • Blocking SQL injection or cross-site scripting
  • Inspecting HTTP or HTTPS request characteristics

AWS WAF is commonly used with services such as:

  • Amazon CloudFront
  • Application Load Balancer
  • Amazon API Gateway

Exam trap

AWS WAF is focused on web application traffic, not general VPC traffic.

  • WAF: Filters HTTP/HTTPS requests at the web application layer.
  • Security group: Controls traffic to a resource.
  • Network ACL: Controls traffic at the subnet boundary.

3. Security Assessments and Penetration Testing

AWS customers may conduct security assessments and penetration testing against certain AWS services without prior approval, provided they follow AWS policies and rules.

However:

  • Permission is not automatically granted for every AWS service.
  • Activities must comply with the current AWS penetration testing policy.
  • Some types of testing or activities may require approval or may be prohibited.
  • Customers are responsible for ensuring that testing does not affect other AWS customers or violate AWS policies.

Exam tip

If a question asks whether penetration testing is allowed:

  • Do not assume that all testing is freely permitted.
  • The correct approach is to check the current AWS policy and the service-specific requirements.
  • Certain services and testing activities are allowed without prior approval, while others may not be.

4. AWS Security Recommendations and Assessments

AWS Trusted Advisor

AWS Trusted Advisor provides recommendations that can help improve an AWS environment.

Relevant recommendation categories include:

  • Security
  • Cost optimization
  • Performance
  • Fault tolerance
  • Service limits

Examples of security-related checks can include identifying:

  • Publicly accessible resources
  • Weak security configurations
  • Unrestricted access
  • Missing security-related controls

Amazon Inspector

Amazon Inspector helps identify vulnerabilities and security issues in supported AWS workloads.

It can provide findings related to:

  • Software vulnerabilities
  • Unintended network exposure
  • Security issues in workloads such as EC2 instances and container images, depending on the supported feature

Trusted Advisor vs. Amazon Inspector

Service Main purpose
AWS Trusted Advisor General AWS environment recommendations, including security checks
Amazon Inspector Vulnerability and exposure assessment for supported workloads

Exam tip

  • “Recommendations across the AWS account” → Trusted Advisor
  • “Find vulnerabilities in workloads or software” → Amazon Inspector

5. AWS Marketplace

The AWS Marketplace is an online catalog where customers can find, purchase, and deploy:

  • Third-party security software
  • Monitoring tools
  • Networking products
  • Business applications
  • Other commercial or free software products

AWS Marketplace can be used when a requirement cannot be met by AWS-native services alone or when an organization prefers a third-party solution.

Exam trap

AWS Marketplace is not itself a security service. It is a place to find and obtain software and solutions from AWS partners and third-party vendors.

6. Security Information and Learning Resources

AWS provides several resources for researching security topics and finding answers.

AWS Knowledge Center

Use the AWS Knowledge Center to find answers to common AWS questions and troubleshooting guidance.

AWS Security Center

The AWS Security Center provides information about AWS security services, security practices, and security-related guidance.

AWS Security Blog

The AWS Security Blog contains articles about:

  • AWS security services
  • Security best practices
  • New security features
  • Implementation examples
  • Security use cases

AWS Security Forum

The AWS Security Forum can help customers find discussions and information from the AWS community.

AWS Documentation and Whitepapers

  • AWS documentation: Service descriptions, features, use cases, and configuration guidance
  • AWS best-practice documentation: Recommended approaches for operating securely
  • AWS whitepapers: More detailed guidance and deeper explanations of AWS security and architecture topics

Exam tip

If a question asks where to find:

  • An answer to a common AWS question → AWS Knowledge Center
  • Security-related information → AWS Security Center
  • Community discussions → AWS Security Forum
  • Detailed service information → AWS documentation
  • Deeper architectural guidance → AWS whitepapers

Quick Service Selection Guide

Requirement Best fit
Protect an EC2 instance or other resource Security group
Control traffic entering or leaving a subnet Network ACL
Explicitly deny traffic Network ACL
Automatically allow response traffic Security group
Filter HTTP/HTTPS requests AWS WAF
Block SQL injection or cross-site scripting AWS WAF
Get general account recommendations AWS Trusted Advisor
Assess workload vulnerabilities Amazon Inspector
Obtain third-party security software AWS Marketplace
Find answers to common AWS questions AWS Knowledge Center

Example CLF-C02 Questions

Question 1

A company needs to control traffic entering and leaving an Amazon VPC subnet. The company must also be able to explicitly deny traffic from a specific IP address. Which solution should it use?

A. Security group
B. Network ACL
C. AWS WAF
D. AWS Trusted Advisor

Answer: B. Network ACL

Explanation: Network ACLs operate at the subnet level and support both allow and explicit deny rules.

Question 2

An application running on an EC2 instance receives an inbound request. The application must send a response, but the administrator does not want to create a separate rule for the response traffic. Which feature provides this behavior?

A. Stateless network ACL
B. AWS WAF
C. Stateful security group
D. AWS Trusted Advisor

Answer: C. Stateful security group

Explanation: Security groups are stateful. Return traffic for an allowed connection is automatically allowed.

Question 3

A company wants to block web requests that contain SQL injection patterns and requests with specific HTTP headers. Which AWS service should it use?

A. AWS WAF
B. Network ACL
C. Security group
D. Amazon Inspector

Answer: A. AWS WAF

Explanation: AWS WAF filters HTTP and HTTPS requests using conditions such as IP addresses, HTTP headers, URLs, and attack patterns.

Question 4

Which statement correctly describes security groups?

A. They are associated with subnets and support explicit deny rules.
B. They are stateless and require separate rules for response traffic.
C. They are associated with resources and are stateful.
D. They can only filter web traffic such as HTTP and HTTPS.

Answer: C. They are associated with resources and are stateful.

Explanation: Security groups operate at the resource or network interface level and automatically allow return traffic for permitted connections.

Question 5

A security team wants recommendations about security weaknesses and configuration issues across its AWS environment. Which service should it review first?

A. AWS Trusted Advisor
B. AWS Marketplace
C. AWS WAF
D. Amazon CloudFront

Answer: A. AWS Trusted Advisor

Explanation: Trusted Advisor provides recommendations across several categories, including security.

Question 6

A company wants to deploy a third-party firewall product into its AWS account. Where should the company look for available third-party software?

A. AWS Security Center
B. AWS Marketplace
C. AWS Knowledge Center
D. AWS Trusted Advisor

Answer: B. AWS Marketplace

Explanation: AWS Marketplace provides third-party software and solutions that can be purchased and deployed in AWS.

Final Exam Summary

Remember these core associations:

  • Security group = resource-level, stateful, allow rules only
  • Network ACL = subnet-level, stateless, allow and deny rules
  • AWS WAF = web application traffic filtering
  • Trusted Advisor = account recommendations
  • Amazon Inspector = workload vulnerability assessment
  • AWS Marketplace = third-party software
  • Knowledge Center and documentation = AWS answers and service information