Which AWS service or feature provides a firewall at the subnet level within a VPC?

Question

Options

• ASecurity group
• BNetwork ACL
• CElastic network interface
• DAWS WAF

• A
  2% (1)
• B
  92% (54)
• C
  2% (1)
• D
  5% (3)

Explanation

Network ACLs (NACLs) act as stateless firewalls at the subnet level, controlling inbound and outbound traffic for all resources within an entire subnet in a VPC. They evaluate rules in numbered order and can explicitly allow or deny traffic, making them the primary subnet-level security boundary in AWS.

Why the other options are wrong:

• A (Security Groups) operate at the instance level (specifically the ENI level), not the subnet level, and are stateful - they automatically allow return traffic.
• C (Elastic Network Interface) is simply a virtual network card that attaches to EC2 instances; it is not a firewall mechanism.
• D (AWS WAF) is a Web Application Firewall that filters HTTP/HTTPS traffic at the application layer, typically used with CloudFront, ALB, or API Gateway - not within VPC subnets.

Memory Tip: Think "NACL = Network = Neighborhood fence" - it protects the entire neighborhood (subnet), while Security Groups are like locks on individual house doors (instances). The "N" in NACL can remind you of "Network level" protection.

No community discussion yet for this question.