CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Network ACLs and Security Groups in AWS
Learn how to distinguish between Network ACLs and Security Groups in AWS. Get exam-ready with this detailed question walkthrough.
Choosing between Network ACLs and Security Groups often trips up candidates. Both serve to enhance security in AWS environments, but they function differently. Understanding these differences is crucial for the SAA-C03 exam.
The question
Which statement correctly distinguishes a Network ACL from a Security Group?
- A. Security groups are stateless and evaluated at the subnet level
- B. Network ACLs are stateful and attached to instances
- C. Security groups are stateful and attached to ENIs; Network ACLs are stateless and evaluated at the subnet level
- D. They are identical in behavior
Think before you scroll
Before picking an answer, consider the definitions and behaviors of both Security Groups and Network ACLs. Focus on their statefulness and the level at which they operate.
The answer
The correct option is C: Security groups are stateful and attached to ENIs; Network ACLs are stateless and evaluated at the subnet level. This statement accurately reflects the fundamental differences between these two security features.
Why the other options lose
- A. Security groups are stateless and evaluated at the subnet level: This statement is incorrect. Security groups are stateful, meaning they track the state of connections. They operate at the instance level, not at the subnet level.
- B. Network ACLs are stateful and attached to instances: This is false because Network ACLs are stateless. They do not track established connections and are evaluated at the subnet level, not attached to individual instances.
- D. They are identical in behavior: This option is misleading. Security Groups and Network ACLs have distinct behaviors and purposes. They cannot be treated as identical.
The concept behind it
Security Groups are stateful firewalls attached to Elastic Network Interfaces (ENIs) that allow or deny traffic based on allowed rules. Network ACLs, on the other hand, are stateless and evaluate traffic at the subnet level, requiring explicit rules for both inbound and outbound traffic. Understanding how these security features differ in terms of statefulness and attachment points is key.
Exam trap to remember
Remember: Security Groups are stateful and work at the instance level, while Network ACLs are stateless and operate at the subnet level. This distinction is crucial for passing the exam.