Question

A company wants to add an additional layer of security at the subnet boundary in their VPC. They need a control that evaluates traffic entering and leaving an entire subnet and that does NOT automatically allow return traffic for permitted connections. Which AWS component meets these requirements?

Accepted Answer

A network ACL, which operates at the subnet level and is stateless

Answer

A security group, which operates at the subnet level and is stateful

Answer

AWS WAF, which filters traffic at the subnet boundary

Answer

An IAM policy applied to the subnet's route table