Control application traffic to an EC2 instance and add a deny rule at the subnet boundary.
Compare the properties of both controls.
Choose TWO correct statements.
Security groups are stateful resource-level controls, while network ACLs are stateless subnet-level controls whose return traffic needs its own rule.
Detailed explanation
NACLs are associated with subnets, not with an individual EC2 instance.
NACLs are associated with subnets, not with an individual EC2 instance.
NACLs apply to subnets and require separate rules for return traffic.
NACLs apply to subnets and require separate rules for return traffic.
Security groups contain allow rules and do not support explicit deny rules.
Security groups contain allow rules and do not support explicit deny rules.
Security groups apply at the resource level and allow return traffic based on connection state.
Security groups apply at the resource level and allow return traffic based on connection state.
Check official documentation
Compare the following points with the official documentation.
AWS VPCのSecurity GroupとNetwork ACLの比較を確認する。
What to confirm
リソース境界とサブネット境界、ステートフルとステートレスを区別できる。
Key points
- Security group
- Network ACL
- Stateful
- Stateless
Notes
- Environment: AWS公式VPCドキュメントの確認
- Confirm current AWS service behavior and security guidance in the official documentation.
Foundation review
Control scope
Security groups protect resources, whereas NACLs provide an additional subnet-boundary layer.
Rule semantics
Security groups allow traffic and have no explicit deny rule; NACLs evaluate ordered allow and deny entries.