A systems administrator is configuring basic security boundaries for a new VPC deployment. To protect the environment, the administrator must understand the functional differences between Security Groups and Network Access Control Lists (Network ACLs). Which TWO statements accurately describe the characteristics of these two resources? (Select TWO.)
- Security Groups operate at the instance level and automatically allow return traffic for approved inbound requests due to their stateful nature.Answer
- Network ACLs operate at the subnet boundary and require explicit outbound rules to permit return traffic because they are stateless.Answer
- CSecurity Groups operate at the subnet boundary and evaluate traffic for all instances within that subnet.
- DNetwork ACLs are stateful firewalls that automatically allow return traffic for any established connection.
- EAWS automatically manages and configures all Security Group rules for customer EC2 instances as part of the shared responsibility model.
Answer
The correct answers are the statements that Security Groups operate at the instance level and are stateful, and Network ACLs operate at the subnet boundary and are stateless.
Security Groups are stateful firewalls that operate at the instance level (specifically the Elastic Network Interface), meaning outbound return traffic is automatically permitted for established inbound connections. In contrast, Network ACLs are stateless firewalls that operate at the subnet boundary, meaning they evaluate inbound and outbound traffic independently, requiring explicit rules in both directions.
Step-by-Step Solution
Key Concept
Comparison of Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level)