thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Intermediate

Network ACL (NACL)

Stateless, subnet-level firewall in AWS VPCs with numbered allow and deny rules evaluated in order.

Definition

Network ACLs evaluate rules from the lowest number and apply the first match. Because they are stateless, return traffic must be explicitly allowed, typically on ephemeral ports 1024-65535. The default NACL allows all traffic; custom NACLs deny all until rules are added. They are useful for blocking specific IP addresses at the subnet boundary.

Example

Rule 90 denies inbound traffic from a malicious /24 before rule 100 allows HTTPS from anywhere.

Exam tip

To block a specific IP address, use a NACL deny rule, because security groups cannot deny.

Don't confuse it with

Related terms