ACloud Guru Certified Cloud Practitioner Practice Exam

What is used to set up a virtual firewall for an EC2 instance?

1. IAM Policy

2. Network ACL

3. Subnet

4. Security Group

The correct answer is: Security Group

A Security Group serves as a virtual firewall for an EC2 instance, allowing you to define inbound and outbound traffic rules that control which data packets are permitted to reach your instance. When you launch an EC2 instance, you can associate it with one or more Security Groups, which provide a way to specify the protocols, ports, and source/destination IP ranges that are allowed or denied. Security Groups operate at the instance level and use stateful filtering, meaning if an incoming request is allowed, the response is automatically allowed, regardless of outbound rules. This makes it an effective tool for managing network security for your EC2 instances in a flexible and intuitive manner. In contrast, while Network ACLs also help in controlling traffic, they apply at the subnet level and use stateless filtering, meaning that every request and response is evaluated against the rules independently. IAM Policies are used to define permissions for users and services but do not provide any direct control over network traffic. Subnets are part of the VPC architecture that defines IP address ranges but do not manage firewall settings. Thus, Security Groups are specifically designed for the function of acting as a virtual firewall for EC2 instances.