Networking & Security Questions
Part of the Cloud Computing Roadmap
In short
"Security group vs network ACL?" is asked in almost every cloud interview. Most people recite "stateful vs stateless". Fewer can explain what that means for a reply packet, and that's the answer that stands out.
'Explain how you'd secure a VPC' or 'what's the difference between a security group and a network ACL?' — testing Phase 2 and Phase 7's networking and security fundamentals.
Think of it like this
Station gate and coach attendant
At the station gate, staff check tickets of everyone going in and coming out, every time, with a fixed list of rules. On the train, the coach attendant remembers you boarded and lets you back in after a chai break without asking again.
Watch it happen
One HTTPS request through a NACL and a security group
TCP to :443
1/6The packet enters the subnet. The NACL checks its numbered inbound rules in order. Rule 100 allows 443.
The big ideas
What you need to know
SG: stateful, allow only
Security groups attach to instances or interfaces, have only allow rules, and track connections so replies pass.
NACL: stateless, ordered
NACLs attach to subnets, support allow and deny, are checked in rule-number order, and need return-traffic rules.
Defence in depth
Securing a VPC is layers: private subnets, tight SGs, NACLs, IAM, encryption, logs. Not one magic setting.
Logs and detection
Mention VPC Flow Logs, CloudTrail and a threat detection service. Knowing what happened matters as much as blocking it.
How it works
Answering "how would you secure a VPC?"
- 1
Subnets
Public subnets only for load balancers and NAT. App servers and databases in private subnets.
- 2
Traffic rules
Security groups that reference each other, NACLs as a coarse extra layer for subnet-wide denies.
- 3
Access
No SSH open to the internet. Use Session Manager or a bastion, plus least-privilege IAM roles.
- 4
Visibility
Flow Logs, CloudTrail and alerts on unusual traffic, all sent to a separate logging account.
Save yourself the pain
Common mistakes
Oops
Saying NACLs and security groups are the same thing at different levels.
Do this instead
Explain the real differences: stateless vs stateful, deny rules, rule order, subnet vs instance.
Oops
Opening port 22 to 0.0.0.0/0 "just for debugging".
Do this instead
Use Session Manager or restrict SSH to your IP, and close it after. Interviewers listen for this.
Your mission
Explain it with a diagram
Quick check
You allowed inbound 443 on a custom NACL but users get timeouts. The security group is fine. Likely cause?
Go deeper
- 1Review Phases 2 and 7 and practice explaining core concepts without notes.
- 2Prepare to diagram a secure VPC layout with public and private subnets.
- 3Practice explaining the principle of least privilege with a concrete IAM policy example.
More services & technical at this stop
Compute & Storage Questions
Database Questions
Stuck on this topic? Ask an Insider
Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.
