A cloud engineer is comparing security groups and network access control lists for a new Amazon VPC and wants to apply each control where it fits best. Which two statements about these two VPC network controls are correct? (Select TWO.)
- AA security group is stateful, so when it allows an inbound request it automatically permits the matching return traffic without a separate outbound rule. Correct
- BA network access control list operates at the subnet boundary and can hold explicit deny rules to block specific source IP addresses. Correct
- CA security group supports explicit deny rules, letting an administrator block one troublesome IP while leaving every other address allowed.
- DA network access control list is stateful, so it remembers permitted connections and lets the return traffic back without its own outbound rule.
- EA security group attaches to a whole subnet at once and therefore governs every instance placed inside that subnet in one step.
Why A is correct: Security groups track connection state, meaning permitted inbound flows have their responses allowed back automatically, which is the defining stateful behaviour.
Why B is correct: Network ACLs evaluate traffic at the subnet level and support both allow and deny entries, so they can explicitly block a chosen IP address.
Why C is wrong: It is tempting to assume both controls work the same, but a security group only holds allow rules and cannot express an explicit deny.
Why D is wrong: This describes a security group; a network ACL is stateless and evaluates inbound and outbound traffic separately, so return traffic needs its own rule.
Why E is wrong: The subnet-wide control is the network ACL; a security group attaches to individual instances rather than to a subnet as a whole.