What is the primary purpose of a security group for EC2 instances in a VPC?
Select an answer to reveal the explanation.
Short Explanation
A security group is the instance's personal stateful firewall — allow what you need on the way in, and return traffic is handled for you. Associate it with the instance (or ENI), not with IAM passwords.
Full Explanation
The primary purpose of a security group for EC2 instances in a VPC is to act as a stateful virtual firewall controlling traffic to and from associated instances (or ENIs). Allow what you need on the way in, and return traffic is handled for you because the control is stateful. Security groups do not store IAM passwords for instance users. They are not a Region-wide DNS firewall for Route 53 only. They do not replace MFA for the root user automatically. Distractors fail by confusing identity storage, DNS firewalling, and root MFA with instance-level traffic filtering. Exam caveat: security groups are allow-rule oriented and stateful; network ACLs add a separate subnet-level stateless layer when needed. Operational check: associate least-privilege security groups with civic instances, avoid 0.0.0.0/0 on administrative ports, document required ingress for each tier, review rules monthly, and use Trusted Advisor or Config to flag overly open groups. In practice, baseline security groups per tier (web, app, data), forbid broad admin port exposure to the world, and let Config or Trusted Advisor re-check after every network change ticket. Pair reviews with change tickets so emergency opens get closed when the incident ends.