Which of the following is true of Amazon EC2 security group?

Which of the following is true of Amazon EC2 security group?
A . You can modify the outbound rules for EC2-Classic.
B . You can modify the rules for a security group only if the security group controls the traffic for just one instance.
C . You can modify the rules for a security group only when a new instance is created.
D . You can modify the rules for a security group at any time.

Answer: D

Explanation:

A security group acts as a virtual firewall that controls the traffic for one or more instances. When you launch an instance, you associate one or more security groups with the instance. You add rules to each security group that allow traffic to or from its associated instances. You can modify the rules for a security group at any time; the new rules are automatically applied to all instances that are associated with the security group.

Reference: http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/using-network-security.html