A new citizen services web tier sits behind an Application Load Balancer. Security wants host-level allow rules for HTTPS from the load balancer only, plus subnet-level explicit denies for known malicious CIDRs. How should SG and NACL responsibilities be split?
Select an answer to reveal the explanation.
Short Explanation
Security groups are the bouncer who only lets the ALB through on 443. NACLs are the street barricades that block known bad neighborhoods at the subnet curb.
Full Explanation
Host-level allow rules and subnet-level explicit denies serve different layers for a citizen services web tier behind an ALB. Security groups should allow TCP 443 only from the ALB security group or ALB ENIs, while network ACLs add subnet-level deny rules for known malicious CIDRs—SG for stateful instance allow posture, NACL for coarse subnet filters including explicit denies. Opening security groups to 0.0.0.0/0 on all ports and relying on NACLs alone weakens host isolation. Disabling security groups because NACLs are stateful is factually wrong—NACLs are stateless and do not replace SG behavior. Allowing SSH from the internet on the instance SG to bypass the ALB for emergency HTTPS expands attack surface contrary to the design. Exam caveat: NACL deny rules need careful ephemeral port planning because of stateless evaluation. Operational check: confirm instance SG references the ALB SG on 443, place a test deny NACL for a lab CIDR, verify blocked probes, and ensure healthy ALB targets still pass citizen HTTPS checks. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure.