AWS Certified Advanced Networking Specialty Practice Exam

Which security feature within a VPC controls stateful traffic?

1. Network Access Control Lists

2. Route Tables

3. Security Groups

4. VPN Connections

The correct answer is: Security Groups

The security feature within a VPC that controls stateful traffic is Security Groups. Security Groups operate at the instance level and are designed to act as virtual firewalls, managing inbound and outbound traffic for associated instances based on defined rules. The key aspect of Security Groups being stateful means that if an inbound request is allowed, the response traffic for that request is automatically allowed regardless of outbound rules. This allows for more intuitive management of security settings, as the connections initiated from the instance can return traffic without needing separate rules defined. In contrast, Network Access Control Lists (ACLs) are stateless; they require you to define both inbound and outbound rules explicitly. Route Tables primarily determine the paths for traffic flow within a VPC but do not provide any direct security controls. VPN Connections facilitate private connections between your VPC and on-premises networks but do not function as a traffic control mechanism that enforces security rules. Therefore, it is the stateful nature and the control over specific instance traffic that clearly make Security Groups the correct answer in this context.