A company is designing its network security controls within an Amazon Virtual Private Cloud (Amazon VPC). The engineering team needs to configure both security groups and network access control lists (network ACLs) to secure their resources.
Which of the following statements correctly describe the operational differences between security groups and network ACLs? (Select TWO.)
- Security groups operate at the instance level, whereas network ACLs operate at the subnet level.Answer
- Security groups are stateful, whereas network ACLs are stateless.Answer
- CSecurity groups operate at the subnet level, whereas network ACLs operate at the instance level.
- DSecurity groups are stateless, whereas network ACLs are stateful.
- ESecurity groups connect multiple VPCs together in a hub-and-spoke topology, whereas network ACLs connect VPCs to on-premises networks.
Answer
Security groups operate at the instance level and are stateful, whereas network ACLs operate at the subnet level and are stateless.
Security groups act as stateful firewalls operating at the instance level, allowing return traffic automatically without requiring an outbound rule. Network ACLs operate as stateless firewalls at the subnet level, which means separate rules must be defined to allow traffic in both directions.
Step-by-Step Solution
Key Concept
VPC Security: Security Groups vs Network ACLs