A county network lead wants subnet-level allow and deny controls for traffic entering and leaving a VPC subnet, not only instance-level rules. Which construct provides that subnet firewall behavior?
Select an answer to reveal the explanation.
Short Explanation
If security groups are apartment door locks, network ACLs are the gate for the whole floor—the subnet. CLF depth is knowing NACLs sit at the subnet and can allow or deny there.
Full Explanation
A network ACL (NACL) is a stateless firewall for a VPC subnet and evaluates inbound and outbound traffic at that subnet boundary, including numbered allow and deny rules. IAM roles authorize API actions, not packet filtering. SCPs constrain account permissions in Organizations and do not replace VPC subnet firewalls. CloudFront origin access patterns protect CloudFront origins, not general EC2 SSH at the subnet layer.