Which VPC endpoint security group rules should be removed to restrict access?
A company runs a workload in a single VPC on AWS. The company’s architecture contains several interface VPC endpoints for AWS services, including Amazon CloudWatch Logs and AWS Key Management Service (AWS KMS). The endpoints are configured to use a shared security group. The security group is not used for any other workloads or resources. After a security review of the environment, the company determined that the shared security group is more permissive than necessary. The company wants to make the rules associated with the security group more restrictive. The changes to the security group rules must not prevent the resources in the VPC from using AWS services through interface VPC endpoints. The changes must prevent unnecessary access. The security group currently uses the following rules: • Inbound - Rule 1 Protocol: TCP - Port: 443 - Source: 0.0.0.0/0 - • Inbound - Rule 2 Protocol: TCP - Port: 443 - Source: VPC CIDR - • Outbound - Rule 1 Protocol: All - Port: All - Destination: 0.0.0.0/0 - Which rule or rules should the company remove to meet with these requirements?
Community Votes
83% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question evaluates understanding that interface VPC endpoint security groups should restrict inbound traffic to the VPC CIDR only, and because security groups are stateful, an explicit allow-all outbound rule is unnecessary for return traffic.
This question tests how to tighten security group rules for interface VPC endpoints by removing overly permissive inbound (0.0.0.0/0) and outbound (All traffic to 0.0.0.0/0) rules while preserving access from within the VPC CIDR.
Many candidates choose to remove only the overly permissive inbound rule (Option A) or keep the outbound rule, forgetting that security groups are stateful and do not require an explicit outbound allow rule for responses to allowed inbound traffic.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Understanding Interface VPC Endpoint Security Groups
Interface VPC endpoints (powered by AWS PrivateLink) are implemented as elastic network interfaces with associated security groups. These security groups control which traffic is allowed to reach the endpoint from within the VPC. To properly secure them, you must restrict both inbound and outbound rules to the minimum necessary.
Analyzing the Current Rules
The current security group configuration is:
- Inbound Rule 1: TCP 443 from
0.0.0.0/0— This allows HTTPS traffic from anywhere on the internet, which is far too permissive for an internal VPC endpoint. - Inbound Rule 2: TCP 443 from
VPC CIDR— This correctly limits HTTPS access to resources within the VPC only. - Outbound Rule 1: All traffic to
0.0.0.0/0— This allows all outbound traffic to any destination, which is unnecessary.
Why the Suggested Answer (B) is Correct
The company must remove Inbound Rule 1 and Outbound Rule 1:
1. Remove Inbound Rule 1 (0.0.0.0/0): Interface VPC endpoints should only be accessed by resources inside the VPC. Keeping 0.0.0.0/0 would allow any internet source to reach the endpoint if routing allowed it, violating the principle of least privilege.
2. Remove Outbound Rule 1 (All to 0.0.0.0/0): Security groups are stateful. This means that if an inbound request is allowed (e.g., TCP 443 from the VPC CIDR), the return traffic is automatically allowed regardless of outbound rules. Therefore, an explicit allow-all outbound rule is unnecessary and overly permissive.
After these removals, Inbound Rule 2 (VPC CIDR on TCP 443) remains, which is exactly what is needed: only VPC resources can initiate connections to the endpoint, and responses flow back automatically.
Why Other Options Are Incorrect
- Option A (Outbound Rule 2): The question text does not even list an "Outbound Rule 2". This option is a distractor based on a typo or misread.
- Option C (Inbound Rule 2 and Outbound Rule 1): Removing Inbound Rule 2 would eliminate the only legitimate rule that allows VPC resources to reach the endpoint, breaking functionality.
- Option D (Outbound Rule 1 only): This leaves the dangerously permissive
0.0.0.0/0inbound rule in place, failing the security review requirement.
Community Insight
As noted by community member secdaddy: "Inbound rule 2 allows traffic from the VPC CIDR to the endpoints incoming so can delete inbound rule 1 which is wider than the VPC CIDR and as SGs are stateful and automatically allow return traffic can delete the outbound rule." This perfectly captures the stateful nature of security groups and the need to scope inbound access to the VPC CIDR only.
Official Reference
Exam Strategy
When a question asks you to make a security group 'more restrictive' for a VPC endpoint, always look for the rule that allows the widest source (0.0.0.0/0) and remove it. Remember that security groups are stateful, so explicit outbound allow rules for return traffic are almost never needed.
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →