Security Groups vs NACLs

WHAT THIS TESTS The interviewer wants to see that you understand statefulness and the layer at which each control applies, and that you treat them as complementary rather than redundant.

A GOOD ANSWER COVERS A security group, called an NSG in Azure, is a virtual firewall attached at the instance or network interface level. Its defining trait is that it is stateful: if you allow an inbound connection, the corresponding return traffic is automatically allowed without a separate outbound rule, and vice versa. AWS security groups support only allow rules with an implicit deny, while Azure NSGs support both allow and deny with priorities. A network access control list, or NACL, operates at the subnet boundary and is stateless: every packet is evaluated independently against ordered, numbered rules, so you must explicitly allow both the request and its return traffic, and NACLs support both allow and deny rules. Because the NACL guards an entire subnet and the security group guards individual instances, they form layers of defense; a packet must pass the subnet NACL and then the instance security group. A broader cloud network firewall adds deep inspection, domain filtering, and centralized policy beyond simple port and IP rules.

COMMON WRONG ANSWERS Describing a NACL as stateful, which leads to broken return-traffic rules. Thinking AWS security groups can have explicit deny rules. Treating the subnet-level and instance-level controls as the same scope.

LIKELY FOLLOW-UPS Why does a stateless NACL need rules for ephemeral return ports? In what order are NACL rules evaluated? When would you reach for a managed network firewall?

ONE CONCRETE EXAMPLE A security group on a web server allows inbound 443 and the reply leaves automatically because it is stateful. The subnet NACL, being stateless, must allow inbound 443 and also outbound on the ephemeral port range for replies to flow.