Which Task Can Security Groups Perform for Amazon EC2?
Short answer
A Security groups act as stateful virtual firewalls for an EC2 instance, so you can allow inbound access through only a specific port.
Question
Key Takeaways
The question tests whether you know security groups are instance-level and stateful, and the trap is confusing them with stateless network ACLs that can explicitly deny traffic at the subnet boundary.
Security groups are stateful virtual firewalls that filter Amazon EC2 instance traffic by protocol, port, and source, so they can allow access through only a specific port. This page confirms why that makes option A correct and why subnet-level denial, CloudFront caching, and stateless filtering belong to other AWS controls.
Common mistake: Many learners pick option B, assuming security groups can deny malicious IP ranges at the subnet level, but that is the job of a network ACL — security groups attach to elastic network interfaces and only allow rules, never deny rules.
Expert Analysis
Why the Answer Is Correct
Security groups are stateful virtual firewalls attached to an Amazon EC2 instance's elastic network interface, and their rules are written as protocol, port range, and source or destination. That rule structure lets an administrator allow inbound access on one port — for example TCP 443 — while blocking every other port, which is exactly what option A describes. Because the group is stateful, return traffic for an allowed request is automatically permitted without a matching outbound rule, so the filtering behaves as a true per-instance firewall. As Mike1987 put it, "should be A", and Jess20 summarized the same layering with "Security Group → Protects the instance (Instance ports)".
Why the Other Options Are Wrong
Option B is wrong because explicit deny rules for IP ranges at the subnet level belong to network ACLs, not security groups. As BShelat quoted from the AWS documentation, "Security groups are stateful", and AWS security groups support allow rules only — there is no deny rule to block a malicious address. Option C is wrong because protecting data cached and served by Amazon CloudFront is handled by CloudFront controls such as signed URLs, origin access control, and AWS WAF, not by an EC2 security group. Option D is wrong because security groups are stateful firewalls, so they cannot be described as stateless; stateless packet evaluation is characteristic of network ACLs.
Community Comment Notes
Community consensus strongly favors option A, with Mike1987, stoy123, Aghajee, and Lyn all landing on port-specific instance access. BShelat and petercorn pointed readers to the AWS VPC security group documentation, which reinforces that stateful behavior is the reason option D fails. Jess20's breakdown of Shield, WAF, network ACLs, and security groups is a useful mental model: DDoS protection, web-application filtering, subnet-level IP control, and instance port control are four different layers.
Official Reference
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a CLF-C02 question mentions a subnet, an explicit deny, or stateless inspection, immediately think network ACL rather than security group. Anchor each control to its scope — instance, subnet, edge, or application — and eliminate the options that operate at the wrong layer.
Frequently Asked Questions
Why can't a security group deny malicious IP addresses at the subnet level?
Why is option D wrong if a security group is a firewall?
Discussion 7 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 7
-
Mike1987 👍 6 Answered Ashould be A
-
BShelat 👍 2 Answered Ahttps://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html Security groups are stateful. For example, if you send a request from an instance, the response traffic for that request is allowed to reach the instance regardless of the inbound security group rules. Responses to allowed inbound traffic are allowed to leave the instance, regardless of the outbound rules. So "D" is NOT the answer. "A" is the correct answer.
-
Aghajee 👍 1A. Allow access to an Amazon EC2 instance through only a specific port. Security groups in AWS are used to control inbound and outbound traffic to and from Amazon EC2 instances. They act as virtual firewalls for your instances. You can define rules in a security group to allow specific traffic based on protocols, ports, and IP address ranges. Therefore, using security groups, you can allow access to an Amazon EC2 instance through only a specific port, effectively controlling the traffic that is permitted.
-
Jess20 👍 1 Answered AShield → Protects from DDoS WAF → Protects web applications (SQL injections, etc) Network ACL → Protects the subnet (IPs) Security Group → Protects the instance (Instance ports)
-
petercorn 👍 1 Answered Ahttps://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html
Show 2 more comments
-
stoy123 👍 1 Answered AA. Allow access to an Amazon EC2 instance through only a specific port.
-
Lyn 👍 1Answer should be A.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →