Correct Answer: No, use Network ACLs or equivalent for explicit deny rules
Security Groups typically support allow rules only. Network ACLs support both allow and deny rules, making them suitable for blocking unwanted IP addresses....
Correct Answer
No, use Network ACLs or equivalent for explicit deny rules
Why This Answer Is Correct
Security Groups typically support allow rules only. Network ACLs support both allow and deny rules, making them suitable for blocking unwanted IP addresses.
This question evaluates your knowledge of Network ACLs — a core concept tested in AWS Certified Solutions Architect – Associate (SAA-C03). Understanding Network ACLs is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
You need stateless firewall rules at the subnet level in your Amazon VPC. What should you configure?
What is the 'Default' behavior of a Network ACL created by a user (not the VPC default NACL)?
When configuring a Network ACL to allow web traffic (port 80) to a subnet, what else must be configured for the connection to work correctly?
Can a Network ACL be associated with multiple subnets in the same VPC?
Which security layer acts as a 'second line of defense' at the subnet level in an AWS VPC?