A cloud administrator wants to configure network security for a new application deployment in a Virtual Private Cloud (VPC). Which TWO of the following statements correctly describe the behavior and boundaries of Security Groups and Network Access Control Lists (Network ACLs)? (Select TWO.)
- Security Groups are stateful (automatically allowing return traffic), whereas Network ACLs are stateless (requiring explicit inbound and outbound rules).Answer
- Security Groups operate at the instance level, whereas Network ACLs operate at the subnet level.Answer
- CSecurity Groups are stateless, meaning outbound rules must be manually configured to allow return traffic.
- DNetwork ACLs are applied to individual EC2 instances to control host-level traffic.
- EBoth Security Groups and Network ACLs are managed exclusively by AWS under the Shared Responsibility Model.
Answer
Security Groups are stateful, whereas Network ACLs are stateless; and Security Groups operate at the instance level, whereas Network ACLs operate at the subnet level.
Security Groups operate at the instance level (specifically elastic network interfaces) and are stateful, automatically allowing return traffic. Network ACLs operate at the subnet level and are stateless, requiring separate inbound and outbound rules to permit return traffic.
Step-by-Step Solution
Key Concept
The operational level and connection tracking state of Security Groups and Network ACLs.