Question

Difficulty: EasyNetwork and Infrastructure Security

An e-commerce startup is designing a secure network environment within a Virtual Private Cloud (VPC). To protect their resources, they plan to use both Security Groups and Network Access Control Lists (Network ACLs). Which two of the following statements correctly describe the characteristics or behavior of these network security features?

  1. Security Groups are stateful, meaning allowed inbound traffic automatically permits return outbound traffic.Answer
  2. Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed by rules.Answer
  3. C
    Security Groups operate at the subnet level to protect all resources inside the subnet.
  4. D
    AWS automatically manages and configures customer Security Group rules as part of the infrastructure security.
  5. E
    Network ACLs automatically perform vulnerability scanning on instances using Amazon Inspector.

Answer

Security Groups are stateful (allowing return traffic automatically) and Network ACLs are stateless (requiring explicit rules in both directions).
Security Groups are stateful firewalls that automatically allow return traffic for established connections. Conversely, Network ACLs are stateless firewalls operating at the subnet boundary, requiring explicit configuration for both inbound and outbound traffic paths.

Step-by-Step Solution

1
Analyze the state characteristics of both network security layers.
Identify that Security Groups automatically track connection state (stateful), while Network ACLs inspect every packet individually and do not track state (stateless).
This establishes the correct behavior of return traffic rules for both tools.
2
Evaluate the operational scope and management boundaries of the remaining choices.
Confirm that Security Groups apply to instances (not subnets), rules must be set by the customer (not AWS), and scanning is done by Amazon Inspector (not Network ACLs).
This eliminates incorrect answers by mapping them to known errors in boundaries, scope, and service functionality.

Key Concept

The primary distinction between Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level) within an AWS VPC.
Rate this question