📖 What is Security Groups?
Security Groups act as virtual firewalls for cloud instances to control inbound and outbound traffic. Unlike network ACLs, which are stateless and operate at the subnet level, security groups are typically stateful and operate at the individual instance or network interface level.
"Focus on the 'stateful' nature. If a request is allowed in, the response is automatically allowed out regardless of the outbound rules configured."
📚 Certification: CCSP (CCSP)
🔑 What are the Key Concepts of Security Groups?
- ▸ Stateful inspection ensures that if an inbound request is permitted, the corresponding outbound response is automatically allowed regardless of outbound rule configurations.
- ▸ Operating at the instance or network interface level enables micro-segmentation, allowing different security postures for resources residing within the same subnet.
- ▸ Most security groups employ a default-deny posture, meaning all traffic is blocked unless an explicit allow rule is configured by the administrator.
- ▸ Rule definitions typically focus on Layer 4 parameters, filtering traffic based on the protocol, port number, and source or destination IP address.
- ▸ Security groups can reference other security groups as sources, allowing dynamic access control based on membership rather than static IP addresses.
🎯 How does Security Groups appear on the CCSP Exam?
You may be asked to troubleshoot a connectivity issue where a user configured an inbound rule for HTTP traffic but forgot the outbound rule; you must identify that stateful nature allows the response.
A scenario might describe a requirement to isolate two virtual machines within the same subnet; expect to identify security groups as the mechanism for achieving this instance-level granularity.
Expect questions where you must choose between a Security Group and a Network ACL based on whether the requirement is for stateful instance filtering or stateless subnet filtering.
❓ Frequently Asked Questions
Can I use a Security Group to explicitly block a specific malicious IP address?
No, most security groups only support 'allow' rules. To explicitly deny a specific IP address while permitting others, you must implement a Network ACL (NACL), which supports both allow and deny rules.
If I have both a Network ACL and a Security Group, which one is evaluated first?
Traffic is first evaluated by the Network ACL at the subnet boundary. If permitted, it then reaches the Security Group at the instance level for a second layer of stateful inspection.