Security Groups vs Network ACLs — how do they differ, and when do you use each?
⚡ Short Answer
Security Groups are stateful, instance-level firewalls (return traffic auto-allowed, allow rules only). NACLs are stateless, subnet-level (evaluate inbound AND outbound separately, support explicit deny). SGs are your primary control; NACLs add coarse subnet-level allow/deny (e.g. block an IP range).
☕Coffee Chat Question
Concept Made Simple
“Security Groups vs Network ACLs — how do they differ, and when do you use each?”
🧠Mind Map Answer
Remember It Faster
🔥What If?
Think Beyond the Expected
You open an inbound port in a NACL but traffic still fails — why?
NACLs are stateless: you must also allow the OUTBOUND return traffic (ephemeral ports), unlike stateful Security Groups which auto-allow return traffic. Forgetting the ephemeral-port outbound rule is the classic NACL gotcha.
😂Real World
Teams manage access mostly with Security Groups (referencing other SGs); NACLs are used sparingly for subnet-wide deny rules. The stateless ephemeral-port trap is a common debugging snag.
🎯Interviewer's Expectation
Keywords they're listening for:
⚠️Common Mistakes
- ✗Forgetting NACL outbound/ephemeral rules
- ✗Using NACLs where SGs suffice
- ✗Overly-broad 0.0.0.0/0 inbound rules
✅Best Practices
- ✓Use SGs as the primary control; reference SGs
- ✓NACLs for coarse subnet deny only
- ✓Least-privilege ingress; avoid open 0.0.0.0/0
🔁Follow-up Questions
- 1Why can a Security Group reference another Security Group?
- 2What are ephemeral ports and why do NACLs need them?
- 3Default SG and NACL behavior?
🧩Related Technologies
Continue Learning with AI
Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.
Plain-language foundations
I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner. Topic: VPC (AWS) Interview question: "Security Groups vs Network ACLs — how do they differ, and when do you use each?" Please: 1. Explain the core idea in simple, plain language, using an everyday analogy. 2. Define any technical terms you use. 3. Walk through one small, concrete example. 4. Finish with a single sentence I can easily remember. Keep the tone friendly and assume I'm new to this topic.
Was this answer helpful?
⭐ Featured Products
Support our platform by exploring our recommended products.
As an Amazon affiliate, purchases through these links may earn us a small commission — at no extra cost to you. It helps keep Full Stack Interview Guru free.