Network Security Controls

• Security groups are stateful, so the return traffic is automatic
• Security groups have no deny rule, you block by not allowing
• NACLs are stateless, so open the ephemeral range for return traffic
• NACLs allow deny rules and evaluate them lowest number first
• A custom NACL denies everything until you add rules
• Use AWS Network Firewall for domain filtering and deep inspection
• Network Firewall runs as endpoints in dedicated firewall subnets
• Enable TGW appliance mode for symmetric routing to inspection
• Site-to-Site VPN is IPsec over the internet, encrypted by default
• Scale VPN past one tunnel with ECMP and dynamic routing
• Direct Connect is private but not encrypted on its own
• MACsec adds Layer 2 encryption to dedicated Direct Connect links
• Run a VPN over a Direct Connect public VIF for end-to-end encryption
• Public VIF reaches AWS services, private VIF reaches a VPC
• AWS Verified Access grants app access per request with no VPN
• Verified Access policy combines a user and a device trust provider
• The strongest isolation is a subnet with no internet or NAT route
• Separate Transit Gateway route tables create isolated route domains
• PrivateLink exposes one service one-way, without peering networks
• Network Access Analyzer proves access from configuration, not traffic
• Inspector network reachability flags externally reachable instances
• Route 53 DNS Firewall defaults to fail-closed and evaluates rule groups by lowest priority first
• Network Firewall only inspects traffic inside HOME_NET, which defaults to the firewall VPC CIDR
• Network Firewall strict rule order honours priority; action order runs pass before drop
• Network Firewall TLS inspection needs TLS_SNI targets and can't see QUIC
• Network Firewall logs a flow only on alert, drop, reject, or pass-with-alert
• AWS managed threat signature rule groups give Network Firewall IPS without custom Suricata rules
• Interface VPC endpoints need an inbound 443 rule from the client workloads
• A VPC endpoint policy filters calls but never grants IAM permissions
• Reference a security group as the source so rules follow auto-scaling, not IPs

Unlock with Premium — includes all practice exams and the complete study guide.