respond to NACL A NACL can be understood as the firewall or protection for the subnet. Considered to be the second layer of defence, which helps protect AWS stack. Controls traffic to or from a subnet according to a set of inbound and outbound rules. Can be used to support and deny rules. Every rules is evaluated based on priority in order. A NACL is considered stateless, any change applied to an incoming rule isn't automatically applied to an outgoing rule. Security Groups A Security group can be understood as a firewall to protect EC2 instances. Considered to be a first level of defence. Controls traffic to or from an EC2 instance according to a set of inbound and outbound rules. Supports rules only, with the default rule being a denial of all rules. All Rules are evaluated before they allow traffic and applied to an instance. Security groups are associated with an instance of a service. These are stateful, which means any changes which are applied to an incoming rule is automatically applied to a rule which is outgoing