A company needs stateless network filtering for its VPC. Which AWS service, tool, or feature will meet this requirement?

Question

Options

• AAWS PrivateLink
• BSecurity group
• CNetwork access control list (ACL)
• DAWS WAF

• A
  2% (1)
• B
  4% (2)
• C
  94% (44)

Explanation

Network Access Control Lists (ACLs) operate at the subnet level and are stateless, meaning they evaluate each packet independently without tracking connection state - every inbound and outbound request must be explicitly allowed or denied. This makes them the ideal choice when stateless filtering is specifically required for a VPC.

Why the others are wrong:

• AWS PrivateLink (A) is a service for privately connecting VPCs to AWS services or other VPCs - it has nothing to do with packet filtering.
• Security Groups (B) are stateful - if you allow inbound traffic, the return outbound traffic is automatically permitted, making them the opposite of what's asked.
• AWS WAF (D) is a web application firewall that filters HTTP/HTTPS traffic at Layer 7, not a general-purpose stateless network filter for VPCs.

Memory Tip: Think of it this way - NACLs = No memory (stateless), Security Groups = Smart memory (stateful). NACLs don't "remember" connections, so every packet must pass through both inbound AND outbound rules independently. If the exam uses the word stateless, immediately think NACL.

No community discussion yet for this question.