During a VPC security review, staff ask how security groups differ from network ACLs. Which comparison is accurate at Cloud Practitioner depth?
Select an answer to reveal the explanation.
Short Explanation
Security groups are like a doorman at each apartment door who remembers the conversation (stateful, per instance). Network ACLs are like building lobby rules on each floor that check every pass in and out separately (stateless, per subnet). Flip that story and the exam trick gets you.
Full Explanation
During a VPC security review, staff should remember that security groups are stateful and filter traffic at the instance (ENI) level, while network ACLs are stateless and filter at the subnet level. Security groups support allow rules and automatically allow return traffic for permitted connections. Network ACLs evaluate inbound and outbound separately, support allow and deny rules, and require explicit ephemeral-port handling because they are stateless. That comparison is the Cloud Practitioner depth distinction.
The reversed claim—security groups as stateless subnet firewalls and NACLs as stateful instance firewalls—is incorrect. Neither control “only encrypts S3 objects,” and network ACLs do not replace IAM policies for API authorization across accounts.
Exam caveat: SG = stateful, ENI/instance; NACL = stateless, subnet, allow+deny. Memorize this pairing for almost every networking security question.
Operational check: show reviewers the security groups on 311 web ENIs and the NACL on their subnet, demonstrate a stateful SG allow versus a stateless NACL rule pair, and document that most microservice allow intent should live in security groups while NACLs provide coarse subnet guardrails.