Which two statements about the Amazon Web Services (AWS) security groups are true? (Choose two.)

Question

Options

• ASecurity groups are applicable at the instance level.
• BEC2 instances, elastic network interfaces (ENIs), and subnets may have security groups
• CA security group is a stateful list of ingress and egress traffic rules.
• DConfigured traffic rules may have an action of allow or deny.

• A
  88% (52)
• B
  3% (2)
• D
  8% (5)

Explanation

A is correct because security groups are enforced at the EC2 instance (or ENI) level, not at the network boundary - each instance can have its own set of inbound/outbound rules.

C is correct because security groups are stateful: if inbound traffic is allowed, the return traffic is automatically permitted without needing a matching outbound rule (and vice versa).

B is wrong because security groups do not apply to subnets - that's the job of Network ACLs (NACLs). Security groups attach to instances and ENIs only.

D is wrong because security groups only support allow rules; there is no explicit deny action. Unmatched traffic is implicitly dropped. NACLs, by contrast, support both allow and deny rules.

Memory tip: Think "SG = Stateful + Instance-level" vs. "NACL = Stateless + Subnet-level + Allow/Deny." The two services are commonly tested as a pair - knowing their contrasts locks in both at once.

No community discussion yet for this question.