Easy👤 3-5 years 1 min read

Security Groups vs Network ACLs — how do they differ, and when do you use each?

Asked inAmazonCognizantAccentureDeloitte
#security group#nacl#stateful#stateless#vpc security
Report issue

⚡ Short Answer

Security Groups are stateful, instance-level firewalls (return traffic auto-allowed, allow rules only). NACLs are stateless, subnet-level (evaluate inbound AND outbound separately, support explicit deny). SGs are your primary control; NACLs add coarse subnet-level allow/deny (e.g. block an IP range).

Coffee Chat Question

Concept Made Simple

Security Groups vs Network ACLs — how do they differ, and when do you use each?

🧠Mind Map Answer

Remember It Faster

Security Groupstateful, instance-level, allow-only
NACLstateless, subnet-level, allow + deny
PrimarySGs for most control
NACL forcoarse subnet deny (block IP range)

🔥What If?

Think Beyond the Expected

You open an inbound port in a NACL but traffic still fails — why?

NACLs are stateless: you must also allow the OUTBOUND return traffic (ephemeral ports), unlike stateful Security Groups which auto-allow return traffic. Forgetting the ephemeral-port outbound rule is the classic NACL gotcha.

😂Real World

Teams manage access mostly with Security Groups (referencing other SGs); NACLs are used sparingly for subnet-wide deny rules. The stateless ephemeral-port trap is a common debugging snag.

🎯Interviewer's Expectation

Keywords they're listening for:

SG stateful/instance/allow-onlyNACL stateless/subnet/allow+denySG primaryephemeral ports for NACL return traffic

⚠️Common Mistakes

  • Forgetting NACL outbound/ephemeral rules
  • Using NACLs where SGs suffice
  • Overly-broad 0.0.0.0/0 inbound rules

Best Practices

  • Use SGs as the primary control; reference SGs
  • NACLs for coarse subnet deny only
  • Least-privilege ingress; avoid open 0.0.0.0/0

🔁Follow-up Questions

  • 1Why can a Security Group reference another Security Group?
  • 2What are ephemeral ports and why do NACLs need them?
  • 3Default SG and NACL behavior?

🧩Related Technologies

VPCephemeral portsSG references

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: VPC (AWS)
Interview question: "Security Groups vs Network ACLs — how do they differ, and when do you use each?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Support our platform by exploring our recommended products.

As an Amazon affiliate, purchases through these links may earn us a small commission — at no extra cost to you. It helps keep Full Stack Interview Guru free.

Related Questions