Network Security Controls

The most-tested network facts on the exam: stateful security groups against stateless NACLs and their ephemeral ports, AWS Network Firewall with stateless, stateful and Suricata rules, segmentation for north/south and east/west traffic, and the tools that prove nobody needs the access you granted.

Content current as of 2026-10.

Lessons

1. Security groups and NACLs
2. AWS Network Firewall
3. Segmentation: north/south and east/west
4. Finding access nobody needs

Sources

• SCS-C03 exam guide — Content Domain 3 (tasks 3.1–3.3)
• Compare security groups and network ACLs — Amazon VPC user guide
• Control subnet traffic with network ACLs (ephemeral ports)
• AWS Network Firewall developer guide — rule groups and policies
• Evaluation order for stateful rules — AWS Network Firewall