A city wants to block entire subnet CIDR ranges from reaching a database subnet even if a security group rule is later misconfigured. Which control should the architect add at the subnet boundary?
Select an answer to reveal the explanation.
Short Explanation
Security groups are the lock on each apartment door; network ACLs are the gate on the whole floor. If you need a subnet-wide block that still helps when a door lock is set wrong, add NACLs. Turning off routing or putting public IPs on databases is not a substitute for that layered control.
Full Explanation
Security groups are stateful firewalls attached to elastic network interfaces, while network ACLs are stateless filters evaluated at the subnet boundary. NACLs can explicitly deny traffic from entire CIDR ranges and provide defense in depth if a security group is overly permissive. Disabling route tables breaks legitimate communication, and public IPs on databases increase exposure rather than enforcing subnet isolation. Architects use both SG and NACL controls deliberately for municipal database subnets.