AWS Interview DropIntermediate TierScenario+25 XP on read
A subnet holds your most sensitive data. Design the Network ACL rules around it as a second layer of defense behind Security Groups.
Core Summary
A NACL earns its place by doing the one thing a Security Group can't: an explicit, subnet-wide deny that survives a misconfigured Security Group rule. The design is a default-deny rule set with narrow, numbered exceptions, remembering that NACLs are stateless, so return traffic on ephemeral ports needs its own explicit allow.
Hints
Hint 1: The value of a NACL is the deny, not the allow; Security Groups already allow fine
Hint 2: Rule numbers matter: lower numbers are evaluated first, first match wins
Hint 3: Stateless means outbound response traffic needs its own inbound rule on ephemeral ports