A transit-agency diagram must place instance-level traffic filters in one layer and subnet-level filters in another. Which pairing is correct?
Select an answer to reveal the explanation.
Short Explanation
Security group = lock on the instance’s network door. NACL = rules for the whole subnet hallway. Same city block, different doors—that classic CLF layering question.
Full Explanation
Security groups associate with elastic network interfaces and therefore control traffic at the instance or ENI layer. Network ACLs associate with subnets and control traffic entering or leaving that subnet. Neither construct attaches to IAM users or KMS keys as packet filters, and both operate inside the VPC path rather than only after traffic leaves AWS. Distinguishing ENI versus subnet placement is a core networking-security comparison.