CLF-C02 Security and Compliance Practice Question
A company needs to allow inbound HTTPS traffic (port 443) to their EC2 web servers while blocking all other inbound traffic. The solution should be stateful — return traffic for allowed inbound connections should automatically be permitted without additional rules. Which AWS feature provides this?
⚠ Common exam trap
Many exam-takers confuse the stateless nature of Network ACLs with the stateful behavior of security groups, assuming NACLs automatically permit return traffic, which they do not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security groups
Security groups act as a stateful virtual firewall for EC2 instances. When you allow inbound HTTPS traffic on port 443, the security group automatically tracks the connection state and permits the corresponding outbound return traffic without requiring an explicit outbound rule. This stateful behavior is inherent to security groups and is the correct choice for the described requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network Access Control Lists (NACLs)
Why it's wrong here
NACLs are stateless firewalls attached at the subnet level, meaning each packet is evaluated independently against the inbound and outbound rule lists. Because they are stateless, you must explicitly add both an inbound rule to allow the initial connection and a separate outbound rule to allow the corresponding return traffic—otherwise the response is dropped. This difference is why NACLs are often contrasted with security groups, which handle return traffic automatically via stateful connection tracking.
- ✗
AWS WAF rules
Why it's wrong here
AWS WAF is a web application firewall that inspects HTTP(S) requests at the application layer to detect and block common attack patterns, such as SQL injection or cross-site scripting. It is not a network-level firewall and does not track TCP/IP connections or maintain session state for general traffic. WAF is typically integrated with CloudFront, Application Load Balancers, or API Gateway, not applied directly to EC2 instances at the security group layer.
- ✓
Security groups
Why this is correct
Security groups are stateful virtual firewalls that operate at the instance level. When you add an inbound rule allowing traffic on port 443, the security group automatically creates a temporary outbound rule to permit the corresponding return traffic, so you do not need to define a separate outbound rule for that response. This connection tracking is the core of stateful filtering, and there is no explicit deny rule—traffic is denied by default unless an allow rule exists.
- ✗
VPC route tables
Why it's wrong here
VPC route tables define the next hop for network packets based on their destination IP address, effectively determining which subnet, gateway, or virtual interface receives the traffic. They do not perform any packet filtering or traffic inspection, and there is no concept of connection state or session tracking in route tables. A route table simply answers 'where does this packet go next?', so it cannot allow or block an inbound connection on port 443 or any other port.
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.