Exam AWS Certified Cloud Practitioner topic 1 question 374 discussion

D. Network access control list (ACL) https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html "A network access control list (ACL) allows or denies specific inbound or outbound traffic at the subnet level. You can use the default network ACL for your VPC, or you can create a custom network ACL for your VPC with rules that are similar to the rules for your security groups in order to add an additional layer of security to your VPC."

D for subnet level, it's ACL

Answer's D. Remember, this is at subnet level, not instance level (which would be A: Security Group)

Should be A base on Qn270 Which AWS service or tool is associated with an Amazon EC2 instance and acts as a virtual firewall to control inbound and outbound traffic? A. AWS WAF B. AWS Shield C. Network access control list (ACL) D. Security group Correct Answer: D Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html

A network access control list (ACL) allows or denies specific inbound or outbound traffic at the subnet level.

D is the answer.