While hardening a city VPC, a trainee lists every AWS security product they have heard of. At Cloud Practitioner depth, which pair remains the core network-level access controls inside a VPC?
Select an answer to reveal the explanation.
Short Explanation
When you zoom into VPC traffic control, start with the classics: security groups (stateful instance-level firewalls) and network ACLs (subnet-level filters). Other services can help you find issues, but day-to-day "who can talk to what on which port" still leans on SG and NACL first.
Full Explanation
Within a VPC, security groups act as stateful firewalls associated with elastic network interfaces, and network ACLs provide optional subnet-level stateless filtering. Together they are the foundational network access controls candidates must identify for CLF-C02. Broader security services may assess configurations or detect findings, but they do not replace understanding security groups and NACLs as the primary VPC traffic filters. Billing, marketplace, or physical appliance options are unrelated distractors.