A county network lead wants subnet-level allow and deny controls for traffic entering and leaving a VPC subnet, not only instance-level rules. Which construct provides that subnet firewall behavior?
Select an answer to reveal the explanation.
Short Explanation
If security groups are apartment door locks, network ACLs are the gate for the whole floor—the subnet. CLF depth is knowing NACLs sit at the subnet and can allow or deny there.
Full Explanation
When a county network lead wants subnet-level allow and deny controls for traffic entering and leaving a VPC subnet—not only instance-level rules—the correct construct is a network ACL (NACL). Network ACLs attach to subnets and evaluate traffic as it crosses the subnet boundary. Unlike security groups, NACLs are stateless and support both allow and deny rules with numbered ordering. That makes them suitable for subnet-wide guardrails in a municipal VPC, such as explicitly denying a known bad CIDR at the perimeter of a public subnet while security groups still refine instance access.
An IAM role attached to an instance profile grants AWS API permissions to applications on the instance; it does not filter packets at a subnet. Confusing identity permissions with network firewalling is a common exam trap. An AWS Organizations SCP constrains which AWS API actions accounts or OUs may call; it does not replace VPC routing tables or act as a subnet firewall for IP traffic. Amazon CloudFront origin access controls protect how CloudFront reaches an S3 (or similar) origin; they are not a mechanism for filtering EC2 SSH at the subnet layer.
Exam caveat: Place controls correctly in diagrams—security group = instance/ENI layer, stateful, allow rules; network ACL = subnet layer, stateless, allow and deny. Cloud Practitioner stems that emphasize “subnet-level” and “allow and deny” point to NACLs.
Operational check: select the subnet used by the county application tier, open its network ACL, confirm ephemeral port handling for return traffic (because NACLs are stateless), add an explicit deny only when a clear subnet-wide block is required, and test connectivity from a bastion after changes. Prefer security groups for most instance micro-segmentation; use NACLs as coarse subnet guardrails that complement, not duplicate, every security-group rule.