During a VPC security review, staff ask how security groups differ from network ACLs. Which comparison is accurate at Cloud Practitioner depth?
Select an answer to reveal the explanation.
Short Explanation
Security groups are like a doorman at each apartment door who remembers the conversation (stateful, per instance). Network ACLs are like building lobby rules on each floor that check every pass in and out separately (stateless, per subnet). Flip that story and the exam trick gets you.
Full Explanation
Security groups act as stateful virtual firewalls associated with elastic network interfaces at the instance level. Network ACLs provide optional stateless allow/deny rules at the subnet boundary. Neither service encrypts S3 objects by itself, and network ACLs do not replace IAM for AWS API authorization.