Exam AWS Certified Cloud Practitioner topic 1 question 798 discussion

I think answer B and C since security groups control access at the instance level and Network Access Control Lists control access at the subnet level

The AWS services or features that will support this requirement are Security groups and Network ACLs. Security groups act as a virtual firewall for your instance to control inbound and outbound traffic. You can add rules to each security group that allows traffic to or from its associated instances based on protocol number, port number, and source or destination IP address. Network ACLs are stateless and provide a rule-based tool for controlling traffic at the subnet level. You can create rules that allow or deny traffic based on protocol number, port number, and source or destination IP address.