An architect is placing network security controls for a cloud-hosted three-tier application and wants to describe the difference between a security group applied to instance interfaces and a network access control list applied to a subnet. Which statement is TRUE of the security group in this comparison?
- AIt evaluates rules statelessly, so return traffic must be permitted by an explicit separate rule in the opposite direction.
- BIt applies to every instance in the subnet regardless of interface membership, because it is bound to the subnet boundary.
- CIt supports ordered numbered rules that are evaluated top to bottom until the first match decides the outcome.
- DIt is stateful, so permitted outbound requests automatically allow their return traffic without a matching inbound rule. Correct
Why A is wrong: Stateless evaluation requiring explicit return rules describes the subnet access control list, not the instance security group, so this reverses the two.
Why B is wrong: Binding to the subnet boundary and applying to all instances describes a subnet-level access control list; a security group applies to the interfaces explicitly associated with it.
Why C is wrong: First-match ordered numbered rules characterise a network access control list; security groups evaluate the whole permissive rule set rather than stopping at a first match.
Why D is correct: Correct: an instance security group is stateful, tracking connections so return traffic for an allowed request is permitted automatically without a separate inbound rule.