What are two main features in Amazon Web Services (AWS) network access control lists (NACLs)?

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:

As per the FortiOS 7.6 AWS Administration Guide and FortiWeb 7.4 cloud deployment documentation, understanding the AWS infrastructure layer is critical for integrating Fortinet virtual appliances. The two features that define AWS Network Access Control Lists (NACLs) are:

Stateless Nature (Option A): Unlike Security Groups, which are stateful (automatically allowing return traffic), NACLs are stateless. This means that if you allow inbound traffic on a specific port, you must also explicitly configure an outbound rule to allow the response traffic to leave the subnet. NACLs evaluate inbound and outbound traffic independently.

Default Configuration (Option C): Every VPC comes with a default NACL. By default, this NACL is configured to allow all inbound and outbound traffic. This is designed to ensure connectivity is not blocked until a custom security posture is defined. However, any custom NACL created manually starts by denying all traffic until rules are added.

Why other options are incorrect:

Option B: NACLs are associated at the subnet level, not the instance level. Security Groups are the components tied directly to an instance’s Elastic Network Interface (ENI).

Option D: NACLs and Security Groups provide defense-in-depth and are designed to be used simultaneously. Traffic must pass through the NACL (subnet level) and then the Security Group (instance level) to reach its destination.