Question

A company is configuring an EC2 instance that hosts a web application. A cloud engineer needs to control inbound traffic at the instance level, allowing only HTTPS (port 443) connections while blocking all other inbound traffic. Which statement correctly describes how a security group behaves in this scenario?

Accepted Answer

Security groups are stateful and use allow rules only; return traffic for an allowed inbound HTTPS connection is automatically permitted.

Answer

Security groups are stateless, so a matching outbound rule must be added manually for the return HTTPS traffic.

Answer

Security groups support both allow and deny rules, so an explicit deny rule is required to block all non-HTTPS traffic.

Answer

Security groups operate at the subnet level, so the rule applies to every instance in the subnet automatically.