SAP-C02
Deep Dive
For the SAP-C02, network security goes far beyond Security Groups and NACLs. Enterprise organizations require deep packet inspection, advanced DDoS protection, and centralized governance of firewall policies across hundreds of accounts.
Contents
Layer 1 — Edge
DDoS protection at the global edge. Absorbs volumetric traffic before it reaches your infrastructure.
Layer 2 — Network
Stateful/stateless L3-L7 packet inspection inside the VPC. Blocks IPs, domains and traffic patterns.
Layer 3 — Subnet
Access control at the subnet level (stateless NACL) and the instance level (stateful SG).
Layer 4 — Application
L7 protection: SQLi, XSS, bots, per-IP/rule rate limiting. Integrates with CloudFront, ALB, API Gateway.
Layer 5 — DNS
Blocks DNS queries to malicious domains before traffic ever leaves the VPC.
AWS Network Firewall is a managed stateful firewall with layer-7 packet inspection (IDS/IPS). It's deployed in a dedicated inspection VPC and traffic is routed through it via a Gateway Load Balancer or TGW route tables.
Rule types
Stateless Rules
Processed before stateful rules. Equivalent to an ACL — evaluates each packet independently. Actions: Pass, Drop, Forward-to-stateful.
Stateful Rules
Tracks connection flows. Supports: 5-tuple rules, domain lists (block by FQDN/domain), Suricata-compatible IPS rules.
Domain Lists
Blocks or allows traffic to lists of domains. Supports wildcards (*.malware.com). Uses SNI inspection for HTTPS.
Suricata Rules
Standard Suricata IDS/IPS rules. Lets you import threat intelligence feeds and custom signatures.
Deployment patterns
Centralized Inspection (recommended)
A dedicated inspection VPC with Network Firewall. Transit Gateway routes all E-W and N-S traffic through the inspection VPC before it reaches its destination. TGW Appliance Mode for flow symmetry.
Distributed (per VPC)
One Network Firewall endpoint per VPC. Simpler but more expensive at scale — each VPC has its own firewall. Use Firewall Manager to centralize policies.
TGW Appliance Mode — critical for stateful inspection
Without Appliance Mode, the TGW can route outbound and return traffic through different Network Firewall endpoints — breaking stateful inspection. With Appliance Mode, the TGW keeps flow symmetry.
WAF (Web Application Firewall) protects web applications against layer-7 attacks: SQL injection, XSS, malicious bots, credential stuffing, and more. It integrates with CloudFront, ALB, API Gateway and AppSync.
| Rule type | Description | SAP-C02 use case |
|---|---|---|
| AWS Managed Rules | AWS-managed rule groups: Core Rule Set (OWASP Top 10), Known Bad Inputs, SQL Database, Linux/Windows OS. | Baseline protection with no configuration effort |
| IP Set Rules | Allow/Block based on lists of IPs or CIDRs. Supports IPv4 and IPv6. | Allowlisting corporate IPs, blocklisting malicious IPs |
| Rate-Based Rules | Blocks IPs that exceed N requests in 5 minutes. Protects against brute force, credential stuffing. | Protecting a login endpoint from brute-force attacks |
| Geo Match Rules | Filters traffic by country of origin. Useful for compliance (GDPR, geographic restrictions). | Blocking regions you don't operate in or that compliance disallows |
| Label Match Rules | Rules that act based on labels assigned by other rules in the same WAF. | Complex rule logic: if rule A matches AND rule B matches → block |
| Bot Control | Identify and manage bots: block malicious bots, allow legitimate bots (Googlebot). | Separating legitimate crawler traffic from malicious scrapers |
WAF with CloudFront (Edge)
WAF acts at CloudFront's edge locations — it blocks malicious traffic before it reaches the AWS region. Minimal latency for blocking. Requires WAF in us-east-1 for global CloudFront.
WAF logging and analysis
WAF logs to Amazon Data Firehose → S3, CloudWatch Logs or Security Hub. Use Athena to analyze attack patterns. WAF traffic sampling in the console for debugging rules.
Shield Standard vs Shield Advanced
Shield Standard (free, included)
Shield Advanced ($3,000/mo + traffic)
When Shield Advanced comes up on the exam
"If a DDoS attack happens during a traffic peak, cost could spike"
→ Shield Advanced includes cost credits — AWS covers the extra cost of resources used to absorb the attack.
"We need expert support during active attacks"
→ AWS's DRT (DDoS Response Team) is available 24/7 with direct access for mitigation.
"We want to see real-time attack metrics"
→ Shield Advanced exposes DDoS metrics in CloudWatch: DDoSDetected, DDoSAttackBitsPerSecond, etc.
"The app runs UDP game servers that must survive DDoS"
→ Shield Advanced with EC2 + Global Accelerator to protect UDP in gaming applications.
DNS Firewall lets you create blocked/allowed domain lists applied to every DNS query leaving your VPC. It detects and blocks communication with C2 (command and control) domains before the TCP/UDP traffic is even established.
Domain Lists
Lists of FQDNs with wildcard support (*.malware.com). AWS provides managed lists of known malicious domains.
Rule Groups
A grouping of rules (Block, Allow, Alert). Associated with a VPC. Multiple rule groups per VPC with priority.
Fail Open/Closed
If DNS Firewall is unavailable: Fail Open (allows queries, higher availability) vs Fail Closed (blocks queries, higher security).
Route 53 Resolver resolves DNS between VPCs and on-premises. Resolver Rules define which DNS queries are forwarded to which DNS servers.
| Rule type | Function | Use case |
|---|---|---|
| Forward Rules | Forwards queries for specific domains to on-premises DNS servers (via Resolver Inbound/Outbound Endpoints) | corp.example.com → the corporate AD's on-premises DNS |
| System Rules | Automatically created by AWS for private hosted zones and split-horizon DNS. Not modifiable. | Resolving native VPC DNS (.amazonaws.com, etc.) |
| Recursive Rules | AWS's DNS (169.254.169.253) resolves public domains when no other rule applies. | Resolving public internet domains |
Resolver Rules + RAM for multi-account
Resolver Rules can be shared with every account in the org via AWS RAM. That way, a single centralized Forward Rule in the Network account lets every account resolve on-premises domains without configuring endpoints in each VPC.
Firewall Manager centrally manages WAF, Shield Advanced, Security Groups, Network Firewall and DNS Firewall policies across every account in the organization. It's the glue that ties every network security tool together.
What Firewall Manager manages
Firewall Manager requirements
Trap: "WAF blocks volumetric L3/L4 DDoS attacks"
Reality: FALSE. WAF operates at L7 (HTTP/S) — it protects against SQLi, XSS, etc. For volumetric DDoS (packet floods) use Shield. They're complementary: Shield absorbs the volume, WAF filters the content.
Trap: "Network Firewall can be deployed directly in a subnet without a dedicated VPC"
Reality: Network Firewall requires its own endpoints (one per AZ). The correct pattern is a dedicated inspection VPC with firewall subnets where the endpoints are created.
Trap: "AWS Config is required for WAF to work"
Reality: AWS Config is required by Firewall Manager (to evaluate policy compliance), not by WAF directly. WAF works without Config.
Trap: "Shield Advanced is included free with Shield Standard"
Reality: FALSE. Shield Standard is included free. Shield Advanced has a fixed cost of $3,000/month + data transfer costs, with a minimum 1-year commitment.
Did you get this topic?
Test what you just learned
A company has 150 AWS accounts in Organizations. The CISO requires every ALB and CloudFront distribution across every account to have a baseline set of WAF rules (OWASP Top 10 + specific geo-restriction blocking), and any new ALB created in the future must also receive these rules automatically with no manual intervention. What is the correct solution?
Put what you learned to the test with original SAP-C02 exam questions.
Start SAP-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.