A city wants to block entire subnet CIDR ranges from reaching a database subnet even if a security group rule is later misconfigured. Which control should the architect add at the subnet boundary?
Select an answer to reveal the explanation.
Short Explanation
Security groups are the lock on each apartment door; network ACLs are the gate on the whole floor. If you need a subnet-wide block that still helps when a door lock is set wrong, add NACLs. Turning off routing or putting public IPs on databases is not a substitute for that layered control.
Full Explanation
When a city needs to block entire subnet CIDR ranges from a database subnet even if a security group is later misconfigured, apply network ACLs on the database subnet as a stateless subnet-level deny in addition to security groups. NACLs evaluate at the subnet boundary and can explicitly deny unwanted CIDRs, providing defense in depth that survives an overly permissive ENI-level security group—useful for isolating municipal database floors from untrusted segments.
Relying only on security groups because they are stateful and “cannot be misconfigured” fails because human error and overly broad SG rules are common failure modes; statefulness does not prevent mistakes. Disabling all route tables so packets cannot leave any subnet fails conceptually: it breaks legitimate application connectivity and is not a targeted CIDR deny control. Replacing security groups with public Elastic IPs on every database instance fails because public addressing increases exposure and does not implement subnet-boundary filtering.
Exam caveat: NACL denies are stateless—you must consider ephemeral return ports for allowed conversations, or legitimate clients will break in subtle ways. Operational check: place explicit deny entries for the unwanted CIDRs (with appropriate rule numbers before broader allows), test that blocked sources cannot reach the DB port, verify allowed app subnets still connect, and document NACL ownership so emergency SG changes cannot silently bypass the subnet policy.