An e-commerce startup is designing a secure network environment within a Virtual Private Cloud (VPC). To protect their resources, they plan to use both Security Groups and Network Access Control Lists (Network ACLs). Which two of the following statements correctly describe the characteristics or behavior of these network security features?
- Security Groups are stateful, meaning allowed inbound traffic automatically permits return outbound traffic.Answer
- Network ACLs are stateless, meaning both inbound and outbound traffic must be explicitly allowed by rules.Answer
- CSecurity Groups operate at the subnet level to protect all resources inside the subnet.
- DAWS automatically manages and configures customer Security Group rules as part of the infrastructure security.
- ENetwork ACLs automatically perform vulnerability scanning on instances using Amazon Inspector.
Answer
Security Groups are stateful (allowing return traffic automatically) and Network ACLs are stateless (requiring explicit rules in both directions).
Security Groups are stateful firewalls that automatically allow return traffic for established connections. Conversely, Network ACLs are stateless firewalls operating at the subnet boundary, requiring explicit configuration for both inbound and outbound traffic paths.
Step-by-Step Solution
Key Concept
The primary distinction between Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level) within an AWS VPC.