Security Group vs Network ACL (AWS): which statement is correct?
Options
- Security Groups are stateful, allow-only; NACLs are stateless, per subnet (Correct option)
- Security Groups are stateless; NACLs are stateful and per instance
- Both are identical and only differ in the console they use
- Security Groups only filter outbound traffic from an instance
Answer
Security Groups are stateful, attached to resources, allow-only rules; NACLs are stateless, apply at subnet level and support allow and deny rules
Why
Security Group: a virtual firewall around an instance/network interface. Stateful: if inbound traffic is allowed, the response is automatically allowed. Only allow rules; everything else is denied.
Network ACL: a firewall at the subnet boundary. Stateless: you must allow return traffic explicitly. Has numbered allow and deny rules.
Most day-to-day control is done with Security Groups. Azure equivalent: Network Security Groups (NSG).
Remember
Security group = stateful, per resource. NACL = stateless, per subnet.