Validation Quiz - MODULE 6
This 30-question quiz allows you to validate your knowledge of AWS network security before moving on to the practical lab.
Question 1
What is the main difference between a Security Group and a NACL?
A) No difference
B) Security Group is stateful at the instance level, NACL is stateless at the subnet level
C) NACL is more secure
D) Security Group is free, NACL is paid
See the answer
Answer: B
Security Groups are stateful (responses to allowed traffic are automatically permitted) and apply at the instance level. NACLs are stateless (explicit rules are needed for both inbound AND outbound traffic) and apply at the subnet level.
Question 2
What does "stateful" mean for a Security Group?
A) It retains the state of the rules
B) If inbound traffic is allowed, outbound response traffic is automatically allowed
C) The rules are permanent
D) It cannot be modified
See the answer
Answer: B
Stateful means that the Security Group tracks the state of connections. If you allow an incoming HTTP request (port 80), the outgoing HTTP response is automatically allowed without needing an explicit outbound rule.
Question 3
What does "stateless" mean for a NACL?
A) It has no state
B) Explicit rules are needed for both inbound AND outbound traffic
C) It is faster
D) It does not support TCP
See the answer
Answer: B
Stateless means that the NACL does not track connections. To allow an HTTP connection, you need an inbound rule for port 80 AND an outbound rule for ephemeral ports (1024-65535) for the response. Each direction is evaluated independently.
Question 4
What is the default behavior of a Security Group for inbound traffic?
A) Everything is allowed
B) Everything is denied
C) Only SSH is allowed
D) Only HTTP is allowed
See the answer
Answer: B
By default, a Security Group denies all inbound traffic. You must explicitly add rules to allow desired traffic. However, outbound traffic is allowed by default.
Question 5
What is the default behavior of a custom NACL for inbound traffic?
A) Everything is allowed
B) Everything is denied
C) Depends on the VPC configuration
D) Same rules as the Security Group
See the answer
Answer: B
A custom NACL denies all traffic by default (inbound and outbound) until rules are added. The default VPC NACL allows all traffic. It's important to distinguish between the two.
Question 6
What is the default behavior of the default VPC NACL?
A) Everything is denied
B) Everything is allowed (inbound and outbound)
C) Only internal traffic is allowed
D) Only SSH is allowed
See the answer
Answer: B
The default NACL created with the VPC allows all inbound and outbound traffic. This is different from a custom NACL you create, which denies everything by default. Be careful not to confuse the two.
Question 7
How are NACL rules evaluated?
A) All rules are evaluated
B) By rule number order, the first matching rule is applied
C) The most specific rule wins
D) Randomly
See the answer
Answer: B
NACL rules are evaluated in ascending numerical order (from lowest to highest). As soon as a rule matches the traffic, it is applied and subsequent rules are ignored. That's why the order of numbers is important.
Question 8
How are Security Group rules evaluated?
A) By priority order
B) All rules are evaluated and if one allows the traffic, it is permitted
C) The first matching rule is applied
D) Alphabetically
See the answer
Answer: B
Unlike NACLs, all rules of a Security Group are evaluated. If at least one rule allows the traffic, it is permitted. There is no concept of priority or order. Security Groups are "allow only" (no deny rules).
Question 9
Can you create DENY rules in a Security Group?
A) Yes
B) No, Security Groups only support ALLOW rules
C) Only for outbound traffic
D) Only for certain ports
See the answer
Answer: B
Security Groups only support ALLOW rules. Anything not explicitly allowed is denied by default. To create explicit DENY rules, you must use NACLs which support both ALLOW and DENY rules.
Question 10
Can you create DENY rules in a NACL?
A) No
B) Yes, NACLs support ALLOW and DENY
C) Only for inbound traffic
D) Only for UDP
See the answer
Answer: B
NACLs support both ALLOW and DENY rules, allowing you to explicitly block certain types of traffic or specific IP addresses. This is useful for blocking known malicious IPs at the subnet level.
Question 11
At what level does a Security Group apply?
A) At the VPC level
B) At the subnet level
C) At the instance (ENI) level
D) At the region level
See the answer
Answer: C
A Security Group applies at the elastic network interface (ENI) level, thus at the instance level. Each instance can have multiple Security Groups, and a Security Group can be associated with multiple instances.
Question 12
At what level does a NACL apply?
A) At the instance level
B) At the subnet level
C) At the VPC level
D) At the AZ level
See the answer
Answer: B
A NACL applies at the subnet level. All inbound or outbound traffic from the subnet is evaluated by the NACL. A subnet can only be associated with one NACL, but a NACL can be associated with multiple subnets.
Question 13
Which NACL rule number represents the default rule (deny all)?
A) 0
B) 100
C) * (asterisk)
D) 999
See the answer
Answer: C
The rule with the number * (asterisk) is the default rule that denies all traffic not matching any other rule. It cannot be modified or deleted. It is always evaluated last.
Question 14
What is the best practice for numbering NACL rules?
A) Use 1, 2, 3, 4...
B) Leave intervals (100, 200, 300...) to insert rules
C) Use random numbers
D) Always start at 1000
See the answer
Answer: B
It is recommended to leave intervals between rule numbers (e.g., 100, 200, 300) to allow inserting new rules between existing ones without having to renumber everything.
Question 15
What are ephemeral ports and why are they important for NACLs?
A) Ports reserved for AWS
B) Temporary ports (1024-65535) used for responses, necessary in outbound NACL rules
C) Ports for encryption
D) Ports for monitoring
See the answer
Answer: B
Ephemeral ports are temporary ports dynamically allocated by the system to receive responses. For NACLs (stateless), you must allow ephemeral ports (1024-65535) outbound so that responses to incoming requests can pass.
Question 16
Can you reference a Security Group in a rule of another Security Group?
A) No
B) Yes, you can allow traffic from another Security Group
C) Only in the same subnet
D) Only for SSH
See the answer
Answer: B
You can reference a Security Group as a source in a rule of another Security Group. For example, the database Security Group can allow traffic on port 3306 from the application servers' Security Group, without specifying IP addresses.
Question 17
What is the advantage of referencing a Security Group rather than an IP address?
A) It's faster
B) The rule automatically applies to all instances of the referenced SG, even if their IPs change
C) It's cheaper
D) No advantage
See the answer
Answer: B
By referencing a Security Group, the rule automatically applies to all instances that have this SG, regardless of their IP addresses. It's more dynamic and maintainable, especially with Auto Scaling where IPs change often.
Question 18
How many Security Groups can you attach to an instance by default?
A) 1
B) 5
C) Unlimited
D) 10
See the answer
Answer: B
By default, you can attach up to 5 Security Groups to a network interface (thus to an instance). This limit can be increased via a quota request. All rules of all attached SGs are evaluated together.
Question 19
Where are NACLs evaluated in relation to Security Groups for inbound traffic?
A) Security Group first, then NACL
B) NACL first, then Security Group
C) In parallel
D) Only the NACL
See the answer
Answer: B
For inbound traffic: NACL is evaluated first (at the subnet level), then the Security Group (at the instance level). For outbound traffic: Security Group first, then NACL. Traffic must be allowed by both.
Question 20
An instance cannot receive HTTP traffic. The Security Group allows port 80 and the NACL denies port 80. What happens?
A) Traffic is allowed thanks to the Security Group
B) Traffic is denied because the NACL blocks it before reaching the instance
C) Traffic is partially allowed
D) It depends on the priority
See the answer
Answer: B
Traffic is denied. The NACL is evaluated first, before the Security Group. If the NACL denies the traffic, it never reaches the instance and the Security Group is not even evaluated. Traffic must be allowed by BOTH to pass.
Question 21
Which diagnostic command allows you to test connectivity on a specific port?
A) ping
B) telnet or nc (netcat)
C) traceroute only
D) nslookup
See the answer
Answer: B
telnet IP PORT or nc -vz IP PORT allow you to test if a specific port is accessible. ping only tests ICMP (and can be blocked). These tools help distinguish Security Group/NACL issues from application issues.
Question 22
Is ICMP (ping) traffic allowed by default in Security Groups?
A) Yes
B) No, you must add an explicit rule
C) Only for internal traffic
D) Only from the VPC
See the answer
Answer: B
By default, ICMP (ping) traffic is not allowed in Security Groups. You must add a specific inbound rule for ICMP (Type: All ICMP - IPv4 or Echo Request) if you want to be able to ping the instances.
Question 23
How can you allow an instance in a private subnet to access the Internet for updates?
A) Add a route to the IGW
B) Use a NAT Gateway and add a route 0.0.0.0/0 to the NAT
C) Open port 80 in the Security Group
D) It's not possible
See the answer
Answer: B
For a private instance to access the Internet, you need a NAT Gateway in a public subnet and a route in the private subnet's route table: 0.0.0.0/0 -> nat-xxx. The Security Group must also allow outbound traffic (by default, it does).
Question 24
What is the best practice for securing SSH access to production instances?
A) Open port 22 to 0.0.0.0/0
B) Limit port 22 to specific IPs or use a bastion host
C) Disable SSH completely
D) Use port 2222 instead of 22
See the answer
Answer: B
Never open SSH (port 22) to 0.0.0.0/0 in production. Limit access to specific IP ranges (your office, VPN) or use a bastion host in a public subnet. AWS Systems Manager Session Manager is an alternative without an open SSH port.
Question 25
What is a bastion host (jump box)?
A) A database server
B) A server in a public subnet serving as a secure SSH entry point
C) A type of load balancer
D) A managed AWS service
See the answer
Answer: B
A bastion host is a hardened EC2 instance in a public subnet that serves as a single entry point for SSH connections. Administrators connect to the bastion first, then from there to private instances. This reduces the attack surface.
Question 26
Which AWS tool allows you to analyze VPC network traffic logs?
A) CloudWatch Logs
B) VPC Flow Logs
C) AWS Config
D) GuardDuty only
See the answer
Answer: B
VPC Flow Logs capture information about IP traffic to and from VPC network interfaces. Logs can be sent to CloudWatch Logs or S3. They are essential for troubleshooting and security analysis.
Question 27
What does ACCEPT mean in a VPC Flow Logs entry?
A) The packet was accepted by AWS
B) The packet was accepted by the Security Group and/or the NACL
C) The application responded
D) The packet was encrypted
See the answer
Answer: B
ACCEPT in Flow Logs means that the traffic was allowed by the Security Groups and NACLs. REJECT means it was denied. Note: ACCEPT does not guarantee that the application responded, only that the network rules allowed it.
Question 28
You see many REJECTs in the Flow Logs for a specific port. What does this indicate?
A) The application has bugs
B) Traffic is being blocked by Security Groups or NACLs
C) The DNS server is not responding
D) The VPC is misconfigured
See the answer
Answer: B
Repeated REJECTs indicate that traffic is being blocked by security rules. This could be legitimate traffic misconfigured (check the rules) or unauthorized access attempts (normal and expected for malicious traffic).
Question 29
Which NACL rule should be added to allow HTTP responses (port 80)?
A) Inbound: Allow TCP 80
B) Outbound: Allow TCP 1024-65535 (ephemeral ports)
C) Outbound: Allow TCP 80
D) None, it's automatic
See the answer
Answer: B
For a NACL (stateless), you need an inbound rule for port 80 AND an outbound rule for ephemeral ports (1024-65535) because responses use dynamically allocated ephemeral ports. This is a common mistake when configuring NACLs.
Question 30
In what order should you check for network connectivity issues?
A) Application, then Security Group, then NACL
B) NACL, then Security Group, then Application, then Route Table
C) Route Table, then NACL, then Security Group, then Application
D) All at once
See the answer
Answer: C
The logical order of checking follows the traffic path: 1) Route Table (can the traffic reach the subnet?), 2) NACL (does the subnet allow the traffic?), 3) Security Group (does the instance allow the traffic?), 4) Application (is the service listening?).
Result
Count your correct answers:
- 27-30: Excellent - You master AWS network security
- 22-26: Good - Some points to review
- 17-21: Average - Review the course before the lab
- Less than 17: Insufficient - Go through the course from the beginning
Proceed to the VPC Troubleshooting Lab once you have achieved at least 22 correct answers.