A VPC needs layered controls for subnet and instance traffic.
The team must distinguish subnet-level and resource-level behavior.
Choose TWO correct statements.
Network ACLs apply stateless rules at the subnet boundary, while security groups apply stateful virtual-firewall rules to resources such as EC2.
Detailed explanation
A network ACL controls subnet traffic, not IAM authentication requirements.
A network ACL controls subnet traffic, not IAM authentication requirements.
Security groups are associated with resources and automatically allow return traffic for an allowed flow.
Security groups are associated with resources and automatically allow return traffic for an allowed flow.
Network ACLs are associated with subnets and require return traffic to be allowed explicitly.
Network ACLs are associated with subnets and require return traffic to be allowed explicitly.
DNS-zone management is a Route 53 concern; security groups control network traffic.
DNS-zone management is a Route 53 concern; security groups control network traffic.
Check official documentation
Compare the following points with the official documentation.
Amazon VPCのsecurity groupとnetwork ACLの公式比較を確認する。
What to confirm
NACLとセキュリティグループの適用単位とステート性を説明できる。
Key points
- Network ACL
- Security group
- Stateless and stateful
Notes
- Environment: AWS公式VPCドキュメントの確認
- Confirm current AWS service behavior and pricing conditions in the official documentation.
Foundation review
Scope
Network ACLs and security groups apply at different layers.
Defense in depth
Using both can provide subnet guard rails and resource-specific controls.