In AWS, what is the difference between a security group and a network ACL, and when would you reach for each?
What they are really testing: Whether you know stateful versus stateless filtering and the instance-versus-subnet layer. Mixing these up causes return-traffic bugs that are painful to debug, so they want the stateful detail specifically.
A real interview question
In AWS, what is the difference between a security group and a network ACL, and when would you reach for each?
What most people say
drag me
“They are both firewalls, you can use either one, they do the same thing.”
It misses the two distinctions that matter operationally: stateful versus stateless, and instance versus subnet. Treating a NACL like a security group leads to allowing inbound but forgetting the return rule, then a confusing one-way connectivity outage.
The follow-ups they ask next
You added an inbound allow rule on a NACL and traffic still fails. What is the classic mistake?
NACLs are stateless, so the return traffic needs its own outbound allow rule on the ephemeral port range. The inbound rule alone is not enough.
Two instances in the same subnet need to talk to each other. Does a NACL apply to that traffic?
A NACL only filters traffic crossing the subnet boundary, so same-subnet traffic is not filtered by it. Security groups still apply, so reference one security group from another to allow it.
What the interviewer is listening for
- Calls security groups stateful and NACLs stateless
- Knows the instance vs subnet layer
- Knows NACLs support deny and are evaluated in order
What sinks the answer
- Says they are interchangeable
- Forgets NACL return traffic must be explicitly allowed
- Cannot say which layer each one attaches to
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“A security group is [stateful] and sits on [the instance or ENI]; a network ACL is [stateless] and sits on [the subnet]. With a NACL I must also allow [the return traffic on ephemeral ports]. I use security groups [as the everyday control] and reach for a NACL when I need [a subnet-wide deny].”
Keep going with networking
Foundation
What is a VPC, and what is a subnet within it? Why split a network into subnets at all?
Foundation
What is the difference between TCP and UDP, and when would you choose each?
Foundation
What happens, step by step, when you type a URL into a browser and press enter?
Foundation
How does DNS resolution actually work, and what is the difference between an A record and a CNAME?
Foundation
What is the difference between IPv4 and IPv6, and why does IPv6 exist?
Junior
An EC2 instance in a private subnet needs to download OS updates from the internet. Walk me through how you make that work, and why.
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free