2.5 Network Security

AWS Certified Cloud Practitioner CLF-C02

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Cloud Practitioner (CLF-C02) Exam Study Strategies and Exam Tips

2 Domain 1: Cloud Concepts (24%)

1.1 What Is Cloud Computing? 1.2 Cloud Deployment Models 1.3 AWS Well-Architected Framework 1.4 Cloud Migration Strategies 1.5 Cloud Economics

3 Domain 2: Security and Compliance (30%)

2.1 The AWS Shared Responsibility Model 2.2 AWS Identity and Access Management (IAM) 2.3 AWS Security Services 2.4 Compliance and Governance 2.5 Network Security

4 Domain 3: Cloud Technology and Services (34%)

3.1 AWS Compute Services 3.2 AWS Storage Services 3.3 AWS Database Services 3.4 AWS Networking and Content Delivery 3.5 Management and Governance Services 3.6 AI/ML and Analytics Services 3.7 Application Integration and Other Services

5 Domain 4: Billing, Pricing, and Support (12%)

4.1 AWS Pricing Models 4.2 Billing and Cost Management Tools 4.3 AWS Support Plans 4.4 Additional Billing Concepts and Services

6 AWS Services Deep Dive

5.1 Compute Services Deep Dive 5.2 Storage and Database Deep Dive 5.3 Security Services Deep Dive 5.4 Architecture Best Practices and Design Principles 5.5 Practice Exam — Mixed Domain Questions

2.5 Network Security

Key Takeaways Explain This Topic AI

Security Groups are stateful, instance-level firewalls that support Allow rules only — return traffic is automatically allowed.

Network ACLs are stateless, subnet-level firewalls that support both Allow and Deny rules and require explicit inbound AND outbound rules.

A VPC is an isolated virtual network; public subnets use an Internet Gateway while private subnets use a NAT Gateway for outbound-only internet access.

VPC endpoints provide private access to AWS services without the internet — Gateway Endpoints for S3/DynamoDB, Interface Endpoints (PrivateLink) for most others.

Direct Connect is a dedicated private link, VPN is an encrypted internet tunnel, and Transit Gateway interconnects many VPCs and on-premises networks.

Last updated: June 2026

Security Groups vs. Network ACLs

Understanding the difference between Security Groups and Network ACLs (NACLs) is one of the most reliably tested topics on the exam. Both control network traffic in a VPC, but they operate differently.

Security Groups (Instance-Level Firewall)

A Security Group is a virtual firewall at the instance level (specifically the network interface).

• Feature Detail
• Level Instance (network interface)
• Stateful Yes — return traffic is automatically allowed
• Rules Allow rules ONLY (no Deny rules)
• Default Denies all inbound; allows all outbound
• Evaluation All rules evaluated before a decision
• Association Attached to instances; an instance can have multiple Security Groups
• Network ACLs (Subnet-Level Firewall)

A Network ACL is a firewall at the subnet level . All traffic entering or leaving the subnet is checked against its rules.

• Feature Detail
• Level Subnet
• Stateful No — stateless; you must define inbound AND outbound rules
• Rules Both Allow AND Deny rules
• Default Default NACL allows all inbound and outbound traffic
• Evaluation Rules evaluated in number order (lowest first); first match wins
• Association One NACL per subnet; a NACL can be associated with multiple subnets
• Head-to-Head Comparison

• Feature Security Group Network ACL
• Operates at Instance level Subnet level
• Supports Allow rules only Allow AND Deny rules
• Stateful? Yes No (stateless)
• Rule evaluation All rules evaluated In number order, first match wins
• Default behavior Deny all inbound Allow all (default NACL)

On the Exam: Remember the pairing — Security Groups = stateful + instance level + Allow only ; NACLs = stateless + subnet level + Allow AND Deny . Because Security Groups are stateful, allowing inbound traffic on a port automatically allows the response, regardless of outbound rules.

VPC Fundamentals

A Virtual Private Cloud (VPC) is a logically isolated virtual network in AWS where you launch resources.

• Component Description
• Subnets Subdivisions of a VPC within an AZ (public or private)
• Route Tables Rules that determine where network traffic is directed
• Internet Gateway (IGW) Connects the VPC to the internet for public subnets
• NAT Gateway Lets private-subnet resources reach the internet outbound without being publicly reachable
• VPC Peering Private connection between two VPCs
• VPC Endpoints Private connection from a VPC to AWS services without using the internet
• Public vs. Private Subnets

• Subnet Type Internet Access Typical Use
• Public Direct, via Internet Gateway Web servers, load balancers, bastion hosts
• Private Outbound only, via NAT Gateway Databases, application servers, backends
• VPC Endpoints — Two Types
• Gateway Endpoint — used for Amazon S3 and DynamoDB ; free; added as a route-table target

Interface Endpoint (powered by AWS PrivateLink) — used for most other AWS services; provisions an elastic network interface with a private IP in your subnet

Encryption in Transit

Encryption in transit protects data as it moves between systems:

• Method Description
• SSL/TLS Encrypts web traffic (HTTPS); used by most AWS services
• VPN Encrypted tunnel between on-premises and AWS
• AWS PrivateLink Private connectivity to AWS services without internet exposure
• AWS Direct Connect + MACsec Encrypted dedicated connection
• AWS Network Security Services

• Service Purpose
• AWS Network Firewall Managed network firewall for filtering VPC traffic
• AWS PrivateLink Private connectivity between VPCs and services
• AWS Direct Connect Dedicated private network connection to AWS
• AWS Site-to-Site VPN Encrypted connection over the internet
• AWS Transit Gateway Connect many VPCs and on-premises networks through a central hub
• Amazon Route 53 DNS service that also supports DNS-based routing and health checks

On the Exam: Match the need to the connection type — Direct Connect for a dedicated private link, VPN for an encrypted tunnel over the internet, PrivateLink/VPC Endpoints to reach AWS services without traversing the public internet, and Transit Gateway to interconnect many networks at scale.

Together, layered Security Groups and NACLs, well-designed public/private subnets, VPC endpoints, and encryption in transit implement the Well-Architected Security pillar principle of applying security at all layers (defense in depth).

Building Defense in Depth in a VPC

A typical secure architecture layers these controls. Place internet-facing load balancers in public subnets and application and database tiers in private subnets so backends are never directly reachable from the internet. Attach Security Groups to each tier to allow only the required ports (for example, the web tier accepts 443 from anywhere, while the database tier accepts 3306 only from the app tier's Security Group). Use a restrictive NACL as a coarse subnet-level backstop, a NAT Gateway for outbound patching from private subnets, and VPC endpoints to reach S3 or DynamoDB privately.

This layering is exactly the Well-Architected Security pillar's "apply security at all layers" principle in practice.