Security groups vs NACLs decision in AWS - Quick Revision & Key Differences

Recall & Review

beginner

What is a Security Group in AWS?

A Security Group acts like a virtual firewall for your EC2 instances. It controls inbound and outbound traffic at the instance level and allows only the traffic you specify.

beginner

What is a Network ACL (NACL) in AWS?

A Network ACL is a firewall that controls traffic at the subnet level. It filters inbound and outbound traffic for all instances in the subnet and works with allow and deny rules.

intermediate

How do Security Groups differ from NACLs in terms of statefulness?

Security Groups are stateful, meaning if you allow inbound traffic, the response is automatically allowed outbound. NACLs are stateless, so you must explicitly allow both inbound and outbound traffic.

intermediate

When should you use a Security Group instead of a NACL?

Use Security Groups to control traffic directly to instances because they are easier to manage and stateful. They are best for instance-level security.

intermediate

Why might you use a NACL in addition to Security Groups?

Use NACLs to add an extra layer of security at the subnet level, especially to block specific IP addresses or ranges before traffic reaches instances.

Which AWS security feature is stateful?

A Both Security Group and Network ACL

B Network ACL

C Neither Security Group nor Network ACL

D Security Group

Security Groups remember allowed connections and automatically allow return traffic, making them stateful.

At what level does a Network ACL operate?

A Instance level

B VPC level

C Subnet level

D Region level

Network ACLs control traffic for all instances within a subnet.

Which of the following can have deny rules in AWS?

A Security Groups only

B Network ACLs only

C Both Security Groups and Network ACLs

D Neither Security Groups nor Network ACLs

Network ACLs support explicit deny rules; Security Groups only allow rules.

If you want to block a specific IP address from accessing your subnet, which should you use?

A Network ACL

B Neither

C Both Security Group and Network ACL

D Security Group

Network ACLs can block traffic at the subnet level using deny rules.

Which AWS security feature automatically allows response traffic for allowed inbound connections?

A Security Group

B Network ACL

C Both

D None

Security Groups are stateful and automatically allow return traffic.

Explain the main differences between Security Groups and Network ACLs in AWS.

Think about where they apply and how they handle traffic.

Describe a scenario where using both Security Groups and Network ACLs together improves security.

Consider layering security controls.