A utility OT/IT bridge VPC must allow historian hosts to reach analytics only on specific ports, using security groups as the primary instance-level control and network ACLs as coarse subnet guardrails. Which prescription is correct?
Select an answer to reveal the explanation.
Short Explanation
Security groups are the precise door locks on each machine; NACLs are the hallway gates. Lock historian-to-analytics ports with SG allow rules, then use NACLs only as coarse backup fences. Wide-open SGs with NACL-only dreams miss how AWS expects you to segment.
Full Explanation
Security groups are stateful, ENI-attached allow-lists and are the primary workload firewall control for specific ports between historians and analytics. Network ACLs are stateless subnet-level controls suited to coarse guardrails or explicit subnet denies, not as a full replacement for security group microsegmentation. Opening security groups broadly, disabling both controls, or allowing all protocols within one shared group undermines OT/IT bridge least privilege.