Question

Difficulty: EasyAWS Network Services

A company is designing its network security controls within an Amazon Virtual Private Cloud (Amazon VPC). The engineering team needs to configure both security groups and network access control lists (network ACLs) to secure their resources.

Which of the following statements correctly describe the operational differences between security groups and network ACLs? (Select TWO.)

  1. Security groups operate at the instance level, whereas network ACLs operate at the subnet level.Answer
  2. Security groups are stateful, whereas network ACLs are stateless.Answer
  3. C
    Security groups operate at the subnet level, whereas network ACLs operate at the instance level.
  4. D
    Security groups are stateless, whereas network ACLs are stateful.
  5. E
    Security groups connect multiple VPCs together in a hub-and-spoke topology, whereas network ACLs connect VPCs to on-premises networks.

Answer

Security groups operate at the instance level and are stateful, whereas network ACLs operate at the subnet level and are stateless.
Security groups act as stateful firewalls operating at the instance level, allowing return traffic automatically without requiring an outbound rule. Network ACLs operate as stateless firewalls at the subnet level, which means separate rules must be defined to allow traffic in both directions.

Step-by-Step Solution

1
Evaluate the boundary levels at which security groups and network ACLs are applied within a VPC.
Confirm that security groups secure individual instances (such as Amazon EC2 instances) and network ACLs secure the subnet boundaries.
This establishes where the traffic filtering takes place.
2
Evaluate how connection state is tracked by both firewalls.
Confirm that security groups automatically permit return traffic (stateful), while network ACLs require independent rules for inbound and outbound paths (stateless).
This identifies the difference in rule configuration complexity and behavior.

Key Concept

VPC Security: Security Groups vs Network ACLs
Rate this question