Network Security
Core concepts
Security questions blend identity and network controls. Know security groups (stateful, allow-only, referenced by SG or CIDR), NACLs (stateless, ordered rules, allow and deny), AWS Network Firewall (stateful inspection, domain filtering, IPS), and AWS WAF for HTTP(S). Understand PrivateLink and VPC endpoints (gateway vs interface) to keep traffic off the internet, and AWS Shield for DDoS. For hybrid, know IPsec, MACsec on Direct Connect, and how to enforce encryption in transit. Also know IAM policies for VPC endpoints and S3 bucket policies that restrict access to a VPC endpoint.
Traps
A frequent trap is assuming a NACL rule number order does not matter; it does, and the first match wins. Another is expecting a security group to deny traffic; it cannot, so use NACLs or Network Firewall for explicit deny. Questions may test that a gateway endpoint policy can restrict which buckets are reachable, but the endpoint route must exist. Also remember that WAF protects ALB, CloudFront, and API Gateway, not NLB.
Rule of thumb
Use security groups as the primary allow control, NACLs for coarse subnet guardrails, and Network Firewall for inspection and egress control. Deny by default at the edge.
Worked example
A team must block all outbound traffic to unknown domains while allowing S3. Deploy Network Firewall in a inspection VPC, route egress through it via Transit Gateway, allow the S3 prefix list, and use domain filtering for the rest. Keep a gateway endpoint for S3 to avoid inspection overhead.
Compliance and Governance
Core concepts
Governance questions test how you enforce and prove network controls across accounts. Know AWS Organizations service control policies (SCPs) that restrict actions such as creating internet gateways or non-approved CIDRs, AWS Config rules for continuous compliance (for example, checking that security groups do not allow 0.0.0.0/0 on port 22), and AWS CloudTrail for audit. Understand AWS Firewall Manager for centrally managing WAF, Shield Advanced, security groups, and Network Firewall policies across accounts. Know VPC sharing via AWS Resource Access Manager and centralized egress patterns for consistent policy. Tagging and cost allocation matter for chargeback.
Traps
SCPs do not grant permissions; they only filter. A common trap is expecting an SCP to remove an existing resource. Another is assuming Config rules remediate automatically; they detect unless you configure remediation. Firewall Manager requires Organizations and a delegated administrator. Also remember that shared VPC participants cannot modify resources they do not own, which affects troubleshooting.
Rule of thumb
Enforce guardrails with SCPs, detect drift with Config, and audit with CloudTrail. Centralize inspection and egress so policy is applied once, not per account.
Worked example
An organization wants to prevent any account from creating an internet gateway. Attach an SCP to the OU denying ec2:CreateInternetGateway. Existing gateways remain; use Config to detect them and a remediation action to delete. Log all API calls in CloudTrail for evidence.