Infrastructure Security is the largest single domain on the AWS Certified Security – Specialty (SCS-C02) exam, weighing in at roughly 20% of your score. It’s also the domain that most rewards a network engineer’s instincts and most punishes memorization. The exam rarely asks “what is a security group?” It asks: Traffic is being blocked even though the security group allows it — what else is in the path? You need to permit an inbound connection but deny the return traffic on a specific port range — which control do you reach for? A public-facing application is being hit by a Layer 7 flood — which service stops it, and at which edge?
Those questions are decided by understanding the layered network controls AWS gives you and exactly where each one sits in the packet’s journey. This guide makes that journey mechanical — from the VPC edge down to the elastic network interface — so you can convert the heaviest 20% of the exam into reliable points. It’s a deep dive on the Infrastructure Security portion of the SCS-C02 blueprint; pair it with the Identity and Access Management deep dive and Data Protection for the other heavy domains.
Defense in Depth: The Layers a Packet Crosses
The mental model the exam rewards is a series of concentric controls. A request to a workload inside your VPC can be inspected and filtered at multiple points:
| Layer | Control | Scope |
|---|---|---|
| Edge (global) | Route 53, CloudFront, AWS Shield, AWS WAF | Before traffic reaches your Region |
| VPC boundary | Internet Gateway, NAT Gateway, route tables | Entry/exit of the VPC |
| Subnet | Network ACLs (NACLs) | All traffic crossing a subnet boundary |
| Traffic inspection | AWS Network Firewall, Gateway Load Balancer | Deep packet / domain inspection |
| Instance / ENI | Security groups | The elastic network interface itself |
No single layer is “the” firewall. Real AWS security — and most exam scenarios — combines several. When traffic is unexpectedly allowed or denied, the answer is almost always that a different layer than the one you’re looking at is responsible.
Security Groups vs. Network ACLs: The Most-Tested Comparison
If you learn one thing cold for this domain, make it the difference between security groups and network ACLs. The exam tests it directly and uses it to build subtle distractors.
| Property | Security Group | Network ACL |
|---|---|---|
| Attaches to | ENI / instance | Subnet |
| State | Stateful | Stateless |
| Rules | Allow only | Allow and deny |
| Rule evaluation | All rules evaluated | Rules processed in number order, first match wins |
| Default | Deny all inbound, allow all outbound | Default NACL allows all; custom NACL denies all until you add rules |
The two properties that decide most questions:
Stateful vs. stateless. A security group is stateful: if you allow an inbound request, the response is automatically allowed back out — you never write a return rule. A NACL is stateless: it evaluates each direction independently, so if you allow inbound traffic on port 443, you also must allow the outbound ephemeral port range (typically 1024–65535) for the response, or the return packet is dropped. The classic exam scenario — “the security group is correct but connections still fail” — is very often a NACL missing the ephemeral return rule.
Allow-only vs. allow-and-deny. Security groups can only allow; there is no deny rule. When you need to explicitly block a specific IP or CIDR (say, a malicious source), you cannot do it with a security group — you use a NACL deny rule (or Network Firewall / WAF). This is the other half of the most common trap: “block a single offending IP address” → NACL, not security group.
# NACL example — allow inbound HTTPS, and the required ephemeral return range
# Inbound rules (processed in order, lowest number first)
100 ALLOW TCP 443 0.0.0.0/0 # inbound HTTPS
* DENY ALL 0.0.0.0/0 # implicit final deny
# Outbound rules
100 ALLOW TCP 1024-65535 0.0.0.0/0 # ephemeral ports for responsesA useful production pattern the exam references: security groups can reference other security groups as their source. Instead of hardcoding IPs, you say “allow inbound from the security group attached to my web tier,” and the rule follows those instances wherever they scale.
VPC Design and Segmentation
Good infrastructure security starts with the VPC layout. The exam expects you to reason about public vs. private subnets and the routing that defines them:
- A public subnet has a route to an Internet Gateway (IGW). Instances here can be reached from the internet (if security groups/NACLs allow).
- A private subnet has no route to an IGW. For outbound-only internet access (patching, API calls), it routes through a NAT Gateway that lives in a public subnet.
- A NAT Gateway allows outbound-initiated traffic only — it does not let the internet initiate connections inward. This one-way property is frequently tested.
The tiered pattern that shows up constantly: public subnet for a load balancer, private subnet for application servers, and an isolated subnet with no internet route at all for databases. Segmenting tiers into separate subnets lets you apply distinct NACLs and keep sensitive data off any internet-reachable path.
For securing traffic between VPCs and accounts — Transit Gateway, VPC peering, and PrivateLink — the SCS-C02 exam guide maps how those connectivity choices intersect with the security blueprint.
VPC Endpoints: Keeping AWS Traffic Off the Internet
A recurring exam theme is reaching AWS services without traversing the public internet. The answer is VPC endpoints, and there are two kinds you must distinguish:
| Endpoint type | Backed by | Used for | Access control |
|---|---|---|---|
| Gateway endpoint | Route table entry | S3 and DynamoDB only | VPC endpoint policy |
| Interface endpoint (PrivateLink) | ENI with a private IP | Most other AWS services + your own services | Endpoint policy + security group |
Two exam-critical points:
- Gateway endpoints are free and only support S3 and DynamoDB. They work by adding a route, so there’s no ENI and no security group — you control them with a VPC endpoint policy (a resource-style policy attached to the endpoint).
- Interface endpoints use PrivateLink, provisioning an ENI in your subnet. Because there’s an ENI, you attach a security group to it and can apply an endpoint policy. This keeps calls to services like KMS, Secrets Manager, or Systems Manager entirely on the AWS network.
VPC endpoint policies are also a security control in their own right — an S3 gateway endpoint policy can restrict which buckets are reachable from the VPC, a common data-exfiltration guardrail.
AWS Network Firewall: Deep, Stateful Inspection
Security groups and NACLs filter on IPs and ports. When you need domain-name filtering, deep packet inspection, or intrusion-prevention (IPS) signatures, the managed answer is AWS Network Firewall. It’s a stateful, managed firewall deployed into dedicated firewall subnets, with traffic routed through it.
What the exam expects you to know:
- It supports stateless and stateful rule groups, including Suricata-compatible rules for signature-based detection.
- It can perform domain-based filtering — allow-listing or deny-listing outbound traffic by FQDN (e.g., permit
*.amazonaws.com, block everything else), which security groups cannot do. - It’s the right tool when a scenario needs centralized, inspectable egress control across many VPCs, often combined with a Transit Gateway inspection architecture.
Contrast it with Gateway Load Balancer, which is how you insert third-party virtual appliances (or your own) transparently into the traffic path. Network Firewall is the AWS-native managed option; GWLB is the pattern for bring-your-own inspection.
AWS WAF: Protecting Layer 7
AWS WAF operates at the application layer (Layer 7), inspecting HTTP/HTTPS requests. It attaches to CloudFront, Application Load Balancers, API Gateway, AppSync, and Cognito user pools — not to raw EC2 instances or NLBs.
Core concepts for the exam:
- WAF uses web ACLs containing rules and rule groups. Rules match on conditions — SQL injection, cross-site scripting, request rate, geo-location, IP sets, header/URI patterns — and take an action (
Allow,Block,Count, or CAPTCHA). - AWS Managed Rules provide maintained rule groups (Core Rule Set, known-bad inputs, SQLi, etc.) so you don’t hand-author every signature.
- Rate-based rules throttle sources exceeding a request threshold — the standard mitigation for Layer 7 request floods and credential-stuffing.
Countmode lets you test a rule’s impact without blocking real traffic first — a frequently tested safe-rollout technique.
# Conceptual WAF web ACL logic
Rule 1 (priority 0): AWS Managed - SQL injection rule set -> Block
Rule 2 (priority 1): Rate-based, 2000 req/5min per IP -> Block
Rule 3 (priority 2): Geo match: allow only [US, CA] -> Block others
Default action: AllowAWS Shield and DDoS Protection
DDoS protection is split into two tiers, and the exam wants you to know exactly what each covers:
| Shield Standard | Shield Advanced | |
|---|---|---|
| Cost | Free, automatic for all customers | Paid subscription |
| Protects against | Common Layer 3/4 attacks | Larger, sophisticated L3/4 and L7 attacks |
| Extras | — | 24/7 DDoS Response Team (DRT), cost-protection for scaling, WAF at no extra cost, detailed attack diagnostics |
Key points:
- Shield Standard is always on and free — it defends every AWS account against common volumetric and state-exhaustion attacks at Layers 3 and 4.
- Shield Advanced adds protection for higher-magnitude and application-layer attacks, access to the DDoS Response Team, and financial protection against scaling charges incurred during an attack. It’s the answer whenever a scenario mentions guaranteed DDoS support, cost protection, or advanced attack visibility.
- DDoS defense is architectural too: fronting workloads with CloudFront and Route 53 absorbs and disperses traffic at the edge, and combining Shield Advanced with WAF handles the L7 dimension.
Edge Protection: CloudFront and Route 53
The outermost layer is AWS’s global edge network. For infrastructure security this matters because moving inspection and termination to the edge shrinks your exposed surface:
- CloudFront terminates TLS at the edge, can enforce a minimum TLS version, integrates WAF and Shield, and — with Origin Access Control (OAC) — ensures an S3 origin is reachable only through CloudFront, never directly. Locking an origin behind OAC is a common exam answer for “prevent users from bypassing CloudFront to hit the bucket directly.”
- Route 53 Resolver DNS Firewall filters outbound DNS queries against domain lists — a control against malware calling out to command-and-control domains, and a complement to Network Firewall’s domain filtering.
Common Mistakes on This Domain
| Mistake | Reality |
|---|---|
| Trying to block a specific IP with a security group | Security groups only allow; use a NACL deny rule, WAF, or Network Firewall |
| Forgetting NACL ephemeral return rules | NACLs are stateless — the response needs an explicit outbound rule (ports 1024–65535) |
| Thinking a NAT Gateway allows inbound connections | NAT permits outbound-initiated traffic only |
| Attaching WAF to an EC2 instance or NLB | WAF attaches to CloudFront, ALB, API Gateway, AppSync, or Cognito — Layer 7 endpoints |
| Assuming Shield Advanced is automatic | Only Shield Standard is free and automatic; Advanced is a paid subscription |
| Using a gateway endpoint for KMS or Secrets Manager | Gateway endpoints support only S3 and DynamoDB; everything else needs an interface endpoint |
| Believing security groups evaluate rules in order | Security groups evaluate all rules together; only NACLs are ordered, first-match-wins |
Conclusion
Infrastructure Security rewards a packet’s-eye view of your architecture. If you can trace traffic from the edge (Route 53, CloudFront, Shield, WAF) through the VPC boundary and subnet NACLs down to the stateful security group on the ENI — and name which control does what at each hop — you’ll handle the bulk of this 20% domain. Anchor it with the two comparisons the exam leans on hardest: stateful security groups vs. stateless NACLs, and Shield Standard vs. Advanced. Layer in when to reach for Network Firewall (domain/deep inspection), WAF (Layer 7), and VPC endpoints (private AWS access), and the scenario questions become pattern-matching.
The fastest way to internalize which control solves which scenario is to see many of them, back to back, under exam conditions.
Practice Until the Right Layer Is Obvious
Reading about security groups, NACLs, and WAF builds the model; answering timed, scenario-based questions is what makes the right control jump out on exam day. Concepts explain why each layer exists — practice questions reveal the traps in how they interact.
Sailor.sh’s AWS Security Specialty mock exam bundle is built around the real SCS-C02 domain weights, so Infrastructure Security gets the emphasis its 20% deserves — every question comes with an explanation of why an answer is right, not just which option to choose. Benchmark yourself with the free SCS-C02 practice questions, then close the gaps with full mock exams and a structured SCS-C02 study plan. To see how this domain connects to the rest of the blueprint, review Security Logging and Monitoring and Threat Detection and Incident Response.
Frequently Asked Questions
Why is Infrastructure Security worth 20% of the SCS-C02 exam?
It’s the largest domain because network controls are the foundation of AWS defense in depth — every workload sits behind some combination of security groups, NACLs, VPC design, and edge protection. The exam weights it heavily because misconfigured network controls are one of the most common real-world causes of breaches.
What’s the difference between a security group and a network ACL?
A security group is stateful, attaches to an ENI/instance, and only supports allow rules — if you allow inbound traffic, the response is automatically permitted. A network ACL is stateless, attaches to a subnet, supports both allow and deny rules, and evaluates them in number order. Because NACLs are stateless, you must add explicit rules for the ephemeral return ports. To block a specific IP, you need a NACL (or WAF/Network Firewall), because security groups cannot deny.
When should I use AWS Network Firewall instead of security groups?
Use Network Firewall when you need capabilities beyond IP/port filtering — domain-name (FQDN) filtering, deep packet inspection, or Suricata-compatible intrusion-prevention signatures — especially for centralized, inspectable egress control across VPCs. Security groups and NACLs handle stateful and stateless IP/port filtering; Network Firewall handles the deeper, managed inspection layer.
What does AWS WAF protect, and where does it attach?
AWS WAF inspects HTTP/HTTPS traffic at Layer 7 and attaches to CloudFront distributions, Application Load Balancers, API Gateway, AppSync, and Cognito user pools. It blocks threats like SQL injection, cross-site scripting, and request floods (via rate-based rules). It does not attach directly to EC2 instances or Network Load Balancers.
Is AWS Shield free?
Shield Standard is free and automatically protects every AWS account against common Layer 3/4 DDoS attacks. Shield Advanced is a paid subscription that adds protection against larger and Layer 7 attacks, access to the 24/7 DDoS Response Team, cost protection for attack-driven scaling, and AWS WAF at no additional charge.
What’s the difference between a gateway endpoint and an interface endpoint?
A gateway endpoint uses a route table entry, is free, and supports only S3 and DynamoDB — you secure it with a VPC endpoint policy. An interface endpoint uses AWS PrivateLink to provision an ENI with a private IP in your subnet, supports most AWS services and your own services, and can be secured with both a security group and an endpoint policy. Both keep traffic to AWS services off the public internet.
Ready to make Infrastructure Security a strength? Drill realistic, explained questions with the Sailor.sh SCS-C02 mock exams, then map your full prep with the AWS Security Specialty exam guide for 2026.