An instance-level virtual firewall on EC2 that controls inbound and outbound traffic. It works as an allow-only rule list — there are no explicit deny rules. Stateful: if you allow inbound traffic, the response is automatically allowed out.
Fundamental for CLF-C02 and SAA-C03. Difference from NACLs: security groups are stateful and instance-level; NACLs are stateless and subnet-level. Question: to allow only HTTPS traffic to an EC2 instance → a security group with an inbound rule on port 443.
Security group (AWS) is a concept that can show up on the exam. Check the full guide to see it in context.