CLF-C02 · Question #159
Which AWS tool or feature acts as a VPC firewall at the subnet level?
The correct answer is B. Network ACL. Network ACLs (Access Control Lists) operate at the subnet level in a VPC, acting as a stateless firewall that controls inbound and outbound traffic for entire subnets - making option B correct. Security groups (A) are incorrect because they function at the instance (ENI) level, n
Question
Which AWS tool or feature acts as a VPC firewall at the subnet level?
Options
- ASecurity group
- BNetwork ACL
- CTraffic Mirroring
- DInternet gateway
How the community answered
(29 responses)- B93% (27)
- C3% (1)
- D3% (1)
Explanation
Network ACLs (Access Control Lists) operate at the subnet level in a VPC, acting as a stateless firewall that controls inbound and outbound traffic for entire subnets - making option B correct. Security groups (A) are incorrect because they function at the instance (ENI) level, not the subnet level, and are stateful rather than stateless. Traffic Mirroring (C) is a monitoring feature used to copy network traffic for inspection and analysis - it has no firewall capabilities. An Internet Gateway (D) is simply a VPC component that enables communication between a VPC and the internet, not a firewall mechanism.
Memory Tip: Think of it this way - Network ACL = Neighborhood rules (subnet-wide), while Security Groups = Single house rules (instance-level). The word "subnet" and "ACL" both suggest broader, boundary-level control, which helps you associate NACLs with subnet-level filtering on the exam.
Topics
Community Discussion
No community discussion yet for this question.