A transit-agency diagram must place instance-level traffic filters in one layer and subnet-level filters in another. Which pairing is correct?
Select an answer to reveal the explanation.
Short Explanation
Security group = lock on the instance’s network door. NACL = rules for the whole subnet hallway. Same city block, different doors—that classic CLF layering question.
Full Explanation
For a transit-agency diagram that must place instance-level traffic filters in one layer and subnet-level filters in another, the correct pairing is security groups at the instance or ENI layer and network ACLs at the subnet layer. Security groups attach to elastic network interfaces and provide stateful allow-rule filtering for the instances or ENI-backed resources behind them. Network ACLs attach to subnets and provide stateless allow/deny filtering for traffic entering or leaving that subnet. Together they form a layered VPC network control model that municipal architects should draw accurately.
Security groups do not operate only at the Region boundary, and network ACLs are not applied to Amazon S3 buckets as a substitute for bucket policies and S3 block public access. Network ACLs are not attached to IAM users, and security groups are not attached to KMS keys—those are identity and encryption constructs, not VPC packet filters. It is also incorrect to claim both controls apply only after traffic has already left AWS; they evaluate traffic paths inside the VPC as packets reach ENIs and subnet boundaries.
Exam caveat: Layer diagrams are frequently tested. Remember: SG = ENI/instance, stateful; NACL = subnet, stateless. S3 access control uses policies, ACLs (bucket), and Block Public Access—not VPC network ACLs.
Operational check: in the transit VPC, confirm each subnet shows the intended NACL, confirm ENIs on application instances reference the correct security groups, run connectivity tests from a jump host, and capture the layered diagram in the agency’s architecture repository so new routes or peering changes do not accidentally bypass one layer. Review rule proliferation periodically so NACLs stay coarse and security groups carry most microservice-level allow intent.