Security Groups vs NACLs
layered network access controls.
a security group is stateful and attached to instances or NICs; a NACL is stateless and applied at the subnet.
thinking NACLs are stateful or that security groups support explicit deny rules.
What's really being asked
The interviewer wants to see that you understand statefulness and the layer at which each control applies, and that you treat them as complementary rather than redundant.
The full answer
A security group, called an NSG in Azure, is a virtual firewall attached at the instance or network interface level. Its defining trait is that it is stateful: if you allow an inbound connection, the corresponding return traffic is automatically allowed without a separate outbound rule, and vice versa. AWS security groups support only allow rules with an implicit deny, while Azure NSGs support both allow and deny with priorities. A network access control list, or NACL, operates at the subnet boundary and is stateless: every packet is evaluated independently against ordered, numbered rules, so you must explicitly allow both the request and its return traffic, and NACLs support both allow and deny rules. Because the NACL guards an entire subnet and the security group guards individual instances, they form layers of defense; a packet must pass the subnet NACL and then the instance security group. A broader cloud network firewall adds deep inspection, domain filtering, and centralized policy beyond simple port and IP rules.
The mistakes people make
Describing a NACL as stateful, which leads to broken return-traffic rules. Thinking AWS security groups can have explicit deny rules. Treating the subnet-level and instance-level controls as the same scope.
What usually comes next
Why does a stateless NACL need rules for ephemeral return ports? In what order are NACL rules evaluated? When would you reach for a managed network firewall?
A concrete example
A security group on a web server allows inbound 443 and the reply leaves automatically because it is stateful. The subnet NACL, being stateless, must allow inbound 443 and also outbound on the ephemeral port range for replies to flow.
Interview question
A subnet-level filter allows inbound port 443 but connections still fail. Which property most likely explains the broken return traffic?
- a.Port 443 cannot be used at the subnet level, only at the instance level
- b.NACLs are stateful and automatically block all return traffic by default
- c.Security groups are stateless and need an outbound rule added
- d.The NACL is stateless, so outbound ephemeral-port traffic must be explicitly allowedCorrect
Why? this is the answer
A NACL is stateless, so the inbound allow does not auto-permit the reply; you must allow outbound traffic on the ephemeral port range. Security groups, by contrast, are stateful and handle returns automatically.
Just read this? Test yourself on what you have been reading.
Read the original → docs.aws.amazon.com
- #security
- #networking
- #firewall
- #nacl
- #cloud
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on security — each one lists the topics its interview covers.
See open roles