thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Cloud Computing

Security Group vs Network ACL: What's the Difference?

In AWS, a security group is a stateful virtual firewall attached to instances or network interfaces, with allow rules only. A network ACL is a stateless filter applied at the subnet boundary that evaluates numbered allow and deny rules in order.

Security Group

Full definition
vs

Network ACL (NACL)

Full definition
Security GroupNetwork ACL
Applies toInstance / elastic network interfaceSubnet
StateStateful; return traffic automatically allowedStateless; return traffic must be explicitly allowed
Rule typesAllow onlyAllow and deny
Rule evaluationAll rules evaluated togetherLowest numbered matching rule wins
DefaultDeny all inbound, allow all outboundDefault NACL allows all; custom NACL denies all
Use casePrimary per-workload access controlSubnet-wide blocks such as denying a specific IP range
Remember it

Security groups remember the conversation; NACLs check every packet like they've never met.

Exam tip

The stateful vs stateless distinction is the most-tested point, along with the fact that only NACLs can explicitly deny. Azure's equivalent is the network security group (NSG), which is stateful and supports deny rules.

Tested on

More Cloud Computing look-alikes