Question

Difficulty: EasyNetwork and Infrastructure Security

A systems administrator is configuring basic security boundaries for a new VPC deployment. To protect the environment, the administrator must understand the functional differences between Security Groups and Network Access Control Lists (Network ACLs). Which TWO statements accurately describe the characteristics of these two resources? (Select TWO.)

  1. Security Groups operate at the instance level and automatically allow return traffic for approved inbound requests due to their stateful nature.Answer
  2. Network ACLs operate at the subnet boundary and require explicit outbound rules to permit return traffic because they are stateless.Answer
  3. C
    Security Groups operate at the subnet boundary and evaluate traffic for all instances within that subnet.
  4. D
    Network ACLs are stateful firewalls that automatically allow return traffic for any established connection.
  5. E
    AWS automatically manages and configures all Security Group rules for customer EC2 instances as part of the shared responsibility model.

Answer

The correct answers are the statements that Security Groups operate at the instance level and are stateful, and Network ACLs operate at the subnet boundary and are stateless.
Security Groups are stateful firewalls that operate at the instance level (specifically the Elastic Network Interface), meaning outbound return traffic is automatically permitted for established inbound connections. In contrast, Network ACLs are stateless firewalls that operate at the subnet boundary, meaning they evaluate inbound and outbound traffic independently, requiring explicit rules in both directions.

Step-by-Step Solution

1
Identify the level at which Security Groups and Network ACLs operate.
Security Groups apply at the instance (network interface) level, while Network ACLs apply at the subnet boundary.
This distinguishes the scope of each firewall type.
2
Determine the stateful or stateless behavior of each control.
Security Groups are stateful (allowing return traffic automatically), whereas Network ACLs are stateless (requiring separate inbound and outbound rules).
This dictates how traffic return paths must be configured.
3
Evaluate the shared responsibility boundary for security group configurations.
Customers are responsible for configuring their own firewall rules (Security Groups and Network ACLs).
AWS does not manage customer-specific access control policies.

Key Concept

Comparison of Security Groups (stateful, instance-level) and Network ACLs (stateless, subnet-level)
Rate this question