Which of the following statements are true about security groups and network ACLs in HUAWEI...

The correct answers are B and C . Huawei documentation states that a security group is a collection of access control rules used to protect cloud servers or instances added to that group. Huawei also describes a network ACL as a security service for VPCs or subnets , which means it protects traffic at the subnet level rather than directly protecting individual instances. That makes C correct.

Huawei’s comparison guidance also distinguishes the way rules are processed. Security groups are stateful and their rules work together as a combined access-control set, while network ACLs are processed according to rule priority , which makes B correct. The official Huawei comparison page explicitly frames network ACLs as an additional security layer on top of security groups.

Option A is incorrect because network ACLs are not mandatory by default in the same way security-group association is standard for instances. Option D is not supported by the Huawei VPC/network ACL documentation cited here; the docs emphasize instance-vs-subnet scope and rule handling, not that exact 5-tuple versus 3-tuple split for these two features. Therefore, the best verified answer is B, C .

========