SAA-C03
Deep Dive
Network security in AWS has multiple layers: from Security Groups that protect instances, to GuardDuty that detects advanced threats. The exam frequently presents scenarios where you have to choose the correct layer.
Contents
Security Groups and NACLs are the two firewall layers in a VPC. The exam distinguishes between them frequently — you need to know the exact differences.
| Feature | Security Groups | Network ACLs |
|---|---|---|
| Operating level | Instance (EC2, RDS, Lambda in VPC) | Entire subnet |
| State | Stateful: return traffic automatically allowed | Stateless: inbound AND outbound rules |
| Rules | Allow only. No explicit Deny. | Allow AND Deny. Priority by rule number. |
| Evaluation | All rules evaluated together | Evaluated in ascending numeric order |
| Application | Multiple SGs per instance | One NACL per subnet |
| Default | Denies all inbound, allows all outbound | Allows all inbound and outbound |
Security Groups — stateful
If you allow inbound traffic on port 443, the outbound response is allowed automatically. The SG remembers the connection state. You only need the inbound rule.
NACLs — stateless
You must create rules for both directions. If you allow inbound on port 443, you must also allow outbound on ephemeral ports (1024-65535) so the response can leave.
Most common exam trap
"Block a specific IP": Security Groups do NOT have Deny rules — only Allow. To block a specific IP, you must use a NACL with a Deny rule at the subnet level.
VPC Endpoints let you connect your VPC to AWS services without traffic going over the internet, with no need for an Internet Gateway, NAT Gateway or VPN. They reduce costs and improve security.
Gateway Endpoint
FreeServices: S3 and DynamoDB (only)
An entry in the subnet route table. Traffic to S3/DynamoDB is automatically redirected.
Exam
When Lambda/EC2 accesses S3 without a NAT Gateway = Gateway Endpoint. Free + no internet traffic.
Interface Endpoint (PrivateLink)
Pay per useServices: All others (SQS, SNS, KMS, EC2 API, CloudWatch, etc.)
Creates an ENI (Elastic Network Interface) in the subnet with a private IP. DNS resolves to the endpoint.
Exam
Extra cost per hour + per GB of data. For services other than S3/DynamoDB.
| Service | OSI layer | What it protects | When to use |
|---|---|---|---|
| AWS WAF | L7 (HTTP) | CloudFront, ALB, API GW, AppSync | SQL injection, XSS, bots, rate limiting |
| Shield Standard | L3/L4 | All AWS resources | Basic DDoS protection — free and automatic |
| Shield Advanced | L3/L4/L7 | EC2, ELB, CloudFront, Route 53 | 24/7 DDoS, DRT support, cost protection at scale |
| Network Firewall | L3-L7 | Entire VPC | Stateful VPC traffic inspection with rules |
Amazon GuardDuty
GuardDuty detects threats using ML. Analyzes VPC Flow Logs, CloudTrail, DNS logs.
Enabled account-wide. Requires no agents. Generates Findings that can be sent to EventBridge.
Amazon Inspector
Inspector scans for vulnerabilities in EC2 and container images (ECR).
Integrates with AWS Security Hub. Generates vulnerability reports with CVSS scoring.
Amazon Macie
Macie discovers and protects sensitive data in S3 using ML.
Generates findings about public or unencrypted buckets that contain sensitive data.
Public Subnet
ALB, NAT Gateway, Bastion Host
Minimal exposure. Only what MUST be reachable from the internet.
Private Subnet
EC2, ECS, Lambda in VPC
No direct route to the internet. Egress via NAT Gateway in the public subnet.
Isolated Subnet (DB)
RDS, ElastiCache, Secrets Manager endpoints
No routes to the internet or other networks. Only traffic from the private subnet.
Security layers: IGW, public/private/isolated subnets, SG and NACLs.
Did you get this topic?
Test what you just learned
A company wants its EC2 instances in private subnets to be able to access S3 without going out to the internet. The security team also wants to block a known malicious IP that is trying to reach its subnets. Which combination of services meets both requirements?
Put what you learned to the test with original SAA-C03 exam questions.
Start SAA-C03 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.