DJames617 Service Comparison
Security Group vs Network ACL
Security groups protect resources. NACLs filter subnet traffic.
What They Have in Common
Each option can solve part of the scenario. The exam expects you to choose the one that satisfies the stated constraints with the right operational burden, security boundary, availability model, and cost behavior.
Key Differences
| Option | Primary model | Best use | Security | Availability | Operations and cost |
|---|---|---|---|---|---|
| Security group | Stateful | Allow rules only | ENI/resource level | Applies to reachable resource targets | Low ops; changes are attached to resources |
| Network ACL | Stateless | Allow and deny rules | Subnet level | Applies across subnet traffic paths | Higher rule-order burden; useful for broad subnet filtering |
Typical Exam Clues
Practice After Studying
Return to the certification guide that includes this comparison and launch domain training from there.