While hardening a city VPC, a trainee lists every AWS security product they have heard of. At Cloud Practitioner depth, which pair remains the core network-level access controls inside a VPC?
Select an answer to reveal the explanation.
Short Explanation
When you zoom into VPC traffic control, start with the classics: security groups (stateful instance-level firewalls) and network ACLs (subnet-level filters). Other services can help you find issues, but day-to-day "who can talk to what on which port" still leans on SG and NACL first.
Full Explanation
At Cloud Practitioner depth, the core network-level access controls inside a city VPC remain security groups and network ACLs. Security groups act as stateful, instance- or ENI-level allow-list firewalls: return traffic for allowed connections is automatically permitted. Network ACLs are subnet-level, stateless filters that evaluate allow and deny rules in order for traffic entering or leaving the subnet. Together they answer day-to-day questions such as which ports citizens or peer tiers may reach, which sources are permitted, and which subnet-boundary denials are required for defense in depth while hardening a municipal VPC.
AWS Artifact provides compliance reports and agreements; Marketplace invoices relate to software procurement—neither is a VPC packet filter. Amazon Inspector finds vulnerabilities and assessment findings on workloads; it does not replace security group and NACL rules as the primary network access controls. AWS Snowball Edge devices are edge compute/storage appliances for data transfer and disconnected scenarios, not the default in-VPC firewall pair placed in every Availability Zone for routine access control.
Exam caveat: Remember stateful versus stateless: security groups are stateful; NACLs are not, so ephemeral return ports must be considered in NACL design. Also, NACLs can explicitly deny; security groups only allow. Do not confuse these with AWS WAF (web application layer for HTTP(S) on supported fronts) or with GuardDuty/Inspector (detection/assessment).
Operational check while hardening the city VPC: inventory security group rules for least privilege (no 0.0.0.0/0 on SSH/RDP unless justified and monitored), review NACL deny/allow order on sensitive subnets, verify that application tiers only accept traffic from intended peers (for example ALB security groups), and document change control so temporary firewall openings for contractors do not become permanent civic risk.