Which statement correctly describes a key difference between Security Groups and Network ACLs in a VPC?
A) Security Groups operate at the subnet level, while Network ACLs operate at the instance level.
B) Security Groups are stateless and require explicit outbound rules for return traffic; Network ACLs are stateful.
C) Network ACLs support both allow and deny rules evaluated in order by rule number; Security Groups only support allow rules and evaluate all rules together.
D) Network ACLs can only be associated with one instance at a time, while Security Groups apply to an entire subnet.
Correct Answer: C
Explanation: Network ACLs are stateless, ordered lists of allow/deny rules evaluated by rule number (lowest first) at the subnet boundary. Security Groups, by contrast, are stateful (return traffic is automatically allowed) and operate at the instance/ENI level, supporting only “allow” rules.
Why the others are wrong: (A) reverses the actual scope — Security Groups apply at the instance/ENI level, NACLs at the subnet level. (B) reverses statefulness — Security Groups are stateful, NACLs are stateless. (D) is backwards in both directions.