Controlling EC2 Instance Traffic with Security Groups
Short answer
D Use Security groups to create a virtual firewall that controls inbound and outbound network traffic for specific EC2 instances.
Question
Key Takeaways
The question specifies controlling traffic between 'certain' instances, which requires stateful, instance-level filtering provided by security groups rather than subnet-level Network ACLs.
Security groups act as instance-level virtual firewalls to control network traffic between specific EC2 instances within a VPC.
Common mistake: Candidates often choose Network ACLs because they also filter traffic, but NACLs operate at the subnet level and are stateless, making them unsuitable for targeting specific instances.
Expert Analysis
Why the Answer Is Correct
Security groups are the correct choice because they function as virtual firewalls that operate at the instance level. They allow you to define rules to control inbound and outbound traffic for specific EC2 instances, enabling precise control over communication between 'certain' instances as requested.
Why the Other Options Are Wrong
Network ACLs (A) operate at the subnet level, not the instance level, and are stateless, meaning they cannot easily track connections between specific pairs of instances in the same way. AWS WAF (B) is designed to protect web applications from common web exploits like SQL injection, not general EC2 instance traffic. Amazon GuardDuty (C) is a threat detection service that monitors for malicious activity but does not actively block or control network traffic flows.
Community Comment Notes
Community consensus strongly supports Security Groups, with users noting the keyword 'certain' implies instance-level granularity. As one commenter noted, 'Security group is instance level; NACL is subnet level', highlighting the critical distinction in scope.
Exam Strategy
When a question mentions controlling traffic for 'specific' or 'certain' resources, look for instance-level controls like Security Groups. If the requirement is broader, covering an entire subnet or CIDR range regardless of instance, consider Network ACLs.
Frequently Asked Questions
Why can't I use Network ACLs to control traffic between specific instances?
What is the main difference between Security Groups and NACLs?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
e59311f 👍 1 Answered DThe correct answer is D. Security groups. Security groups act as a virtual firewall that controls inbound and outbound traffic for EC2 instances within a subnet1. You can configure rules in security groups to allow only the minimum required network traffic, such as allowing traffic from specific IP address ranges or specific protocols like HTTPS2. If you need to control network traffic between certain EC2 instances, security groups are the appropriate choice.
-
123asdzxcxza 👍 1 Answered DD, security group is instance level; NACL is subnet level
-
femzy 👍 1 Answered DSecurity groups... keyword is "certain"
-
ShaiTay 👍 1 Answered DD. Security groups
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →