What term refers to stateless filtering rules applied at the subnet level and apply to every resource deployed to the subnet within the VPC or VNE?

What term refers to stateless filtering rules applied at the subnet level and apply to every resource deployed to the subnet within the VPC or VNE?

• A. NACLs
• B. Group Policies and Security Groups
• C. Data Zone
• D. Availability Zone

Answer: (A)

Network Access Control Lists are the subnet-level, stateless filters that apply to every resource launched in that subnet. They sit at the boundary of the subnet, so all traffic entering or leaving the subnet is checked against these rules for all resources inside it. Because they are stateless, they do not remember connections; return traffic is not automatically allowed and must be explicitly permitted by rules for the opposite direction. Rules are evaluated in order, and the first match decides the outcome, with any traffic that doesn’t match a rule being denied by default. This distinguishes them from security groups, which are stateful and attach to individual resources, automatically permitting related return traffic when a connection is allowed. Availability Zone is a regional fault-tolerance construct, not a filtering mechanism, and Data Zone isn’t the standard term for this concept.

Network Access Control Lists are the subnet-level, stateless filters that apply to every resource launched in that subnet. They sit at the boundary of the subnet, so all traffic entering or leaving the subnet is checked against these rules for all resources inside it. Because they are stateless, they do not remember connections; return traffic is not automatically allowed and must be explicitly permitted by rules for the opposite direction. Rules are evaluated in order, and the first match decides the outcome, with any traffic that doesn’t match a rule being denied by default.

This distinguishes them from security groups, which are stateful and attach to individual resources, automatically permitting related return traffic when a connection is allowed. Availability Zone is a regional fault-tolerance construct, not a filtering mechanism, and Data Zone isn’t the standard term for this concept.