AWS Certified Solutions Architect Associate SAA-C03 Practice Question

When you create a security group, it starts with no inbound rules-therefore, all inbound traffic is denied. At the same time, AWS automatically adds a single outbound rule that allows all outbound traffic (all protocols, all ports, 0.0.0.0/0 and ::/0). You must explicitly add inbound rules if you want to permit specific traffic to reach resources associated with the security group. This default configuration aligns with the principle of least privilege by blocking unsolicited inbound access while permitting the instance to initiate outbound connections.