What is the key difference between a security group and a network ACL?
- A Security groups are stateful and allow-only; NACLs are stateless and support deny rules
- B NACLs are stateful
- C Security groups operate at subnet level
- D They are identical
Answer
Security groups are stateful and allow-only; NACLs are stateless and support deny rules
Because NACLs are stateless, return traffic including ephemeral ports must be explicitly allowed, which is a common source of confusion.





