A new citizen services web tier sits behind an Application Load Balancer. Security wants host-level allow rules for HTTPS from the load balancer only, plus subnet-level explicit denies for known malicious CIDRs. How should SG and NACL responsibilities be split?
Select an answer to reveal the explanation.
Short Explanation
Security groups are the bouncer who only lets the ALB through on 443. NACLs are the street barricades that block known bad neighborhoods at the subnet curb.
Full Explanation
Security groups provide stateful instance-level allow rules and should permit HTTPS only from the load balancer. Network ACLs add stateless subnet-level controls and are appropriate for explicit deny ranges. Opening all ports, treating NACLs as a full SG replacement, or exposing SSH from the internet undermines defense in depth.