Network ACLs overview in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a Network ACL in AWS?

A Network ACL (Access Control List) is a security layer for your VPC that controls inbound and outbound traffic at the subnet level. It acts like a firewall to allow or deny traffic based on rules.

intermediate

How does a Network ACL differ from a Security Group?

Network ACLs control traffic at the subnet level and are stateless, meaning return traffic must be explicitly allowed. Security Groups control traffic at the instance level and are stateful, automatically allowing return traffic.

beginner

What does it mean that Network ACLs are stateless?

Stateless means that Network ACLs do not remember previous traffic. If you allow inbound traffic, you must also allow outbound traffic explicitly for the response to pass.

intermediate

What is the default rule behavior in a Network ACL?

By default, Network ACLs allow all inbound and outbound IPv4 traffic and deny all inbound and outbound IPv6 traffic. They have numbered rules evaluated in order from lowest to highest.

beginner

How are Network ACL rules evaluated?

Rules are evaluated in order, starting with the lowest number. The first rule that matches the traffic is applied. If no rules match, the default rule denies the traffic.

What level does a Network ACL control traffic in AWS?

A Subnet level

B Instance level

C Region level

D Availability zone level

Network ACLs control traffic at the subnet level, filtering traffic entering and leaving subnets.

Which statement about Network ACLs is true?

A They are stateless and require explicit rules for return traffic.

B They are stateful and automatically allow return traffic.

C They only control outbound traffic.

D They replace Security Groups.

Network ACLs are stateless, so return traffic must be explicitly allowed by rules.

If no Network ACL rule matches the traffic, what happens?

A Traffic is allowed by default.

B Traffic is denied by default.

C Traffic is logged but allowed.

D Traffic is redirected to a Security Group.

The default rule denies any traffic that does not match any rule.

How are Network ACL rules processed?

A All rules are processed simultaneously.

B Rules are processed randomly.

C Rules are processed in order from lowest to highest number.

D Only the highest numbered rule is processed.

Rules are evaluated in order, starting with the lowest numbered rule.

What is the default Network ACL behavior for IPv4 traffic?

A Allow outbound only.

B Deny all inbound and outbound traffic.

C Allow inbound only.

D Allow all inbound and outbound traffic.

By default, Network ACLs allow all inbound and outbound IPv4 traffic.

Explain how Network ACLs control traffic in an AWS VPC and how they differ from Security Groups.

Think about where the rules apply and how traffic return is handled.

Describe the rule evaluation process in Network ACLs and what happens if no rule matches the traffic.

Consider the order and default behavior.