A security review requires defense-in-depth at the network layer for a three-tier app. Which TWO controls operate at DIFFERENT network layers and complement each other? (Select TWO.)
Choose 2 answers.
A.NACLs — stateless subnet-level allow/deny
Correct. Subnet-level stateless layer.
B.Security groups — stateful instance/ENI-level filtering
Correct. Instance-level stateful layer — complementary to NACLs.
C.Two security groups stacked on the same ENI
Two SGs are the same layer — not defense in depth.
D.Route 53 health checks
Health checks route traffic, they don't filter it.
E.An additional internet gateway
IGWs provide connectivity, not filtering.
Why this answer
NACLs and security groups are complementary layers: NACLs are stateless subnet boundaries (evaluate all rules, support explicit deny), security groups are stateful instance-level firewalls (only allow rules, tracked connections).
Correct answers: A, B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Infrastructure Security practice session.
Practice Infrastructure Security