VocalHyre
Sign up

AWS, Azure & GCP · Cloud across providers

How do security groups and network ACLs differ?

Hardsecurity groupsnetwork aclfirewallUpdated Oct 2026
Quiz this track

Short answer

Security groups are stateful, instance-level allow-only firewalls. Network ACLs are stateless, subnet-level rules that support allow and deny and are evaluated in order.

Both filter network traffic, but at different layers and with different semantics. Security groups attach to resources and remember established connections. Network ACLs attach to subnets and evaluate each packet independently against numbered rules.

Comparison

  • Scope: security groups apply to an instance or ENI; NACLs apply to a whole subnet
  • State: security groups are stateful, so return traffic is automatically allowed; NACLs are stateless
  • Rules: security groups allow only, with an implicit deny; NACLs support allow and deny in rule-number order
  • Operations: security groups are the primary control; NACLs are a coarse subnet guardrail
bash
aws ec2 authorize-security-group-ingress   --group-id sg-0123   --protocol tcp   --port 443   --cidr 10.0.0.0/16

aws ec2 create-network-acl-entry   --network-acl-id acl-0123   --rule-number 100   --protocol tcp   --port-range From=443,To=443   --cidr-block 10.0.0.0/16   --rule-action allow   --ingress
Equivalent ingress intent expressed as a security group rule and a NACL entry.

Because NACLs are stateless, you must allow both the request and the response. A common failure is allowing inbound 443 but forgetting the outbound ephemeral port range, which silently breaks connections. Security groups do not have that problem for established flows.

Do not rely on NACLs for fine-grained application security. Use security groups plus identity and application controls, and treat NACLs as an extra layer for broad subnet policy.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1Why does a stateless NACL need ephemeral port rules?
  2. 2Which control would you use to block a specific CIDR at the subnet boundary?
  3. 3What happens to return traffic in a stateful security group?
  4. 4How do rule numbers affect NACL evaluation?

Say it in the interview

Security groups are stateful firewalls attached to resources, and they only allow traffic. NACLs are stateless subnet-level rules evaluated in order, and they can allow or deny. Because NACLs are stateless, I have to allow both directions, including ephemeral ports. I use security groups as the main control and NACLs as a coarse subnet guardrail.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

MediumWhat are subnets and how do you design them?MediumWhat are the core cloud security practices?MediumHow do virtual networks work?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live AWS, Azure & GCP mock interview and get scored feedback on depth, clarity and confidence.

Start a free AWS, Azure & GCP interviewBrowse all questions