Which Task Can Security Groups Perform for Amazon EC2?
Which task can a company perform by using security groups in the AWS Cloud?
Community Insight
The question tests whether you know security groups are instance-level and stateful, and the trap is confusing them with stateless network ACLs that can explicitly deny traffic at the subnet boundary.
Security groups are stateful virtual firewalls that filter Amazon EC2 instance traffic by protocol, port, and source, so they can allow access through only a specific port. This page confirms why that makes option A correct and why subnet-level denial, CloudFront caching, and stateless filtering belong to other AWS controls.
Many learners pick option B, assuming security groups can deny malicious IP ranges at the subnet level, but that is the job of a network ACL — security groups attach to elastic network interfaces and only allow rules, never deny rules.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Security groups are stateful virtual firewalls attached to an Amazon EC2 instance's elastic network interface, and their rules are written as protocol, port range, and source or destination. That rule structure lets an administrator allow inbound access on one port — for example TCP 443 — while blocking every other port, which is exactly what option A describes. Because the group is stateful, return traffic for an allowed request is automatically permitted without a matching outbound rule, so the filtering behaves as a true per-instance firewall. As Mike1987 put it, "should be A", and Jess20 summarized the same layering with "Security Group → Protects the instance (Instance ports)".Why the Other Options Are Wrong
Option B is wrong because explicit deny rules for IP ranges at the subnet level belong to network ACLs, not security groups. As BShelat quoted from the AWS documentation, "Security groups are stateful", and AWS security groups support allow rules only — there is no deny rule to block a malicious address. Option C is wrong because protecting data cached and served by Amazon CloudFront is handled by CloudFront controls such as signed URLs, origin access control, and AWS WAF, not by an EC2 security group. Option D is wrong because security groups are stateful firewalls, so they cannot be described as stateless; stateless packet evaluation is characteristic of network ACLs.Community Comment Notes
Community consensus strongly favors option A, with Mike1987, stoy123, Aghajee, and Lyn all landing on port-specific instance access. BShelat and petercorn pointed readers to the AWS VPC security group documentation, which reinforces that stateful behavior is the reason option D fails. Jess20's breakdown of Shield, WAF, network ACLs, and security groups is a useful mental model: DDoS protection, web-application filtering, subnet-level IP control, and instance port control are four different layers.Official Reference
Exam Strategy
When a CLF-C02 question mentions a subnet, an explicit deny, or stateless inspection, immediately think network ACL rather than security group. Anchor each control to its scope — instance, subnet, edge, or application — and eliminate the options that operate at the wrong layer.
Frequently Asked Questions
Why can't a security group deny malicious IP addresses at the subnet level?
Security groups attach to EC2 instance network interfaces, support allow rules only, and have no deny rule; explicit subnet-level blocking is done with a network ACL's deny rules.
Why is option D wrong if a security group is a firewall?
A security group is a stateful firewall — return traffic for allowed requests is automatically permitted — whereas network ACLs are the stateless filter in a VPC.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →