Which AWS Tool Acts as a Firewall for a VPC Subnet?

CLF-C02 By islever Editorial Last updated

Identify AWS network services. Identify components and resources for security.

Short answer

D A network ACL acts as the subnet-level firewall that allows or denies traffic entering and leaving an Amazon VPC subnet.

Question

Which AWS service or tool can be used to set up a firewall to control traffic going into and coming out of an Amazon VPC subnet?
  1. Security group
  2. AWS WAF
  3. AWS Firewall Manager
  4. Network ACL Correct Answer

Key Takeaways

The question tests scope mapping (subnet vs. instance vs. web application) against centrally managed policy tools, and the trap is treating the phrase "service or tool" as a hint for AWS Firewall Manager.

Network ACLs are the stateless, subnet-level firewall layer in Amazon VPC that evaluates numbered allow and deny rules for traffic entering and leaving a subnet. This page establishes why a network ACL — not a security group, AWS WAF, or AWS Firewall Manager — is the correct answer here.

Common mistake: Picking AWS Firewall Manager because the stem says "service or tool," or picking security groups, which enforce stateful allow-only rules at the ENI/instance level rather than at the subnet boundary.

Expert Analysis

Why the Answer Is Correct

A network ACL is exactly what AWS documents as the optional security layer that "acts as a firewall for controlling traffic in and out of one or more subnets." It attaches to a subnet, evaluates numbered rules in order, supports both allow and deny statements, and is stateless — which is why return traffic must be explicitly permitted by the outbound and inbound rule sets. The stem's wording, "traffic going into and coming out of an Amazon VPC subnet," is the textbook definition of a network ACL's job, so D is the direct scope match. No other option in the list operates at the subnet boundary with allow/deny evaluation.

Why the Other Options Are Wrong

A security group is a virtual firewall for an instance or elastic network interface, is stateful, and only supports allow rules, so it cannot filter an entire subnet. AWS WAF is a Layer 7 web application firewall that inspects HTTP(S) requests in front of CloudFront, Application Load Balancer, API Gateway, or AppSync — it does not govern arbitrary VPC subnet traffic. AWS Firewall Manager is a central administration service that deploys and maintains AWS WAF, Shield Advanced, security group, and Network Firewall policies across accounts in AWS Organizations; it manages firewall configuration, it is not the subnet-level filter being described. The phrase "service or tool" is generic exam boilerplate and does not convert a management console into the enforcement point.

Community Comment Notes

pietro167's shorthand — "ACL = subnet, Security Groups = instances" — captures the scope distinction that most voters used to reach D. Penny357 and Travisnica instead read "service or tool" as pointing to Firewall Manager, with Travisnica writing that "to set up the firewall you will use AWS Firewall Manager"; that reasoning conflates a multi-account policy manager with the filter that actually guards the subnet. BShelat backed that dissent by noting a NACL is "a list of rules" rather than a management tool, while Val2344 and nocinfra returned to AWS's own framing of network ACLs as a subnet firewall and linked the VPC security comparison documentation. The discussion is a useful reminder that CLF-C02 often tests scope words rather than product marketing language.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a stem names a scope — subnet, instance, or web application — map that scope to the service before you read the options, then eliminate anything whose enforcement point is elsewhere. Treat phrases like "service or tool" as filler rather than as a clue pointing to a management service such as Firewall Manager.

Frequently Asked Questions

Why isn't AWS Firewall Manager the answer if it sets up firewall rules?

Firewall Manager centrally administers WAF, Shield Advanced, security group, and Network Firewall policies across accounts in AWS Organizations; it does not itself enforce subnet-level allow/deny rules the way a network ACL does.

Can a security group control traffic for an entire VPC subnet?

No. Security groups attach to ENIs and instances and are stateful with allow-only rules; subnet-wide filtering with explicit deny rules requires a network ACL associated with that subnet.

More CLF-C02 FAQ →

Discussion 59 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 59

  1. pietro167 👍 51 Answered D
    ACL = subnet, Security Groups = instances
  2. Penny357 👍 10 Answered C
    The Question states "AWS service or tool can be 'used' to set up a firewall" So option is C. And Network ACL is not a AWS service or tool. Correct me if i am wrong.
  3. TheFivePips 👍 5 Answered D
    A. Security group: Acts as a virtual firewall for an Amazon EC2 instance. It controls inbound and outbound traffic at the instance level. While it's an essential component for controlling traffic to and from EC2 instances, it operates at the instance level, not at the subnet level. B. AWS WAF (Web Application Firewall): Focused on protecting web applications from common web exploits. It is used for filtering HTTP traffic and is not designed to control traffic at the VPC subnet level. C. AWS Firewall Manager: A service that helps manage AWS WAF rules across multiple accounts and resources. It is more about central configuration and management of WAF rules, rather than directly controlling traffic at the VPC subnet level. D. Network ACL (Access Control List): A set of rules that control inbound and outbound traffic at the subnet level. It operates at the network layer (Layer 3) and allows or denies traffic based on defined rules for a specific subnet. Network ACLs provide control over traffic entering and leaving a subnet within an Amazon VPC.
  4. Anuj08 👍 4 Answered D
    Security groups and network ACLs are similar in that they allow you to control access to AWS resources within your VPC. But security groups allow you to control inbound and outbound traffic at the instance level, while network ACLs offer similar capabilities at the VPC subnet level.
  5. Travisnica 👍 4 Answered C
    The question says "what service or tool can be used to set up a firewall" so C is the correct answer. It's known that VPC subnet must be associated with a network ACL. However, to set up the firewall you will use AWS Firewall Manager.
Show 25 more comments
  1. nocinfra 👍 4 Answered D
    Network ACLs are an optional layer of security that act as a firewall for controlling inbound and outbound traffic at the subnet level. https://docs.aws.amazon.com/zh_tw/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison
  2. BShelat 👍 4
    You are right. NACL is a list of rules. It is not a tool "to setup and manage" firewall. AWS Firewall Manager is a tool to setup, configure and manage AWS WAF and AWS Shield .
  3. MarysSon 👍 3 Answered C
    C is the correct answer. The AWS Firewall Manager helps to configure a firewall and that’s what this question is asking. ”AWS Firewall Manager simplifies your AWS WAF administration and maintenance tasks across multiple accounts and resources. With AWS Firewall Manager, you set up your firewall rules just once.” A – Security groups are essential to efficiently managing access to resources, but they are not classified as a service. B – Web application firewall is essential to controlling traffic into and out of a network, by setting access rules and monitoring network request, but this is not the best answer. D – Access Control Lists are used to grant or limit access to network and system resources, but they are not classified as a service. Reference: https://AWS Firewall Manager Documentation (amazon.com)
  4. rankocertified 👍 3 Answered D
    Cannot be C: AWS Firewall Manager is a security management service that allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations. As new applications are created, Firewall Manager makes it easier to bring new applications and resources into compliance by enforcing a common set of security rules. therefore the only valid answer is D as it pertains to subnets (VPC)
  5. Anyio 👍 3 Answered A
    The correct answer is A. A security group acts as a firewall that controls the traffic allowed to and from the resources in your virtual private cloud (VPC). You can choose the ports and protocols to allow for inbound traffic and for outbound traffic. https://docs.aws.amazon.com/vpc/latest/userguide/security-groups.html
  6. Val2344 👍 3 Answered D
    The correct answer is D. Network ACL (Access Control List). Network ACLs act as a firewall for controlling traffic in and out of a subnet in Amazon Virtual Private Cloud (VPC). They operate at the subnet level and evaluate traffic based on rules defined for inbound and outbound traffic.
  7. SanePebble 👍 3 Answered D
    Key word is subnet
  8. asdfcdsxdfc 👍 3 Answered D
    D is correct
  9. OZGEGOKCHE 👍 2 Answered A
    A. Security group To control traffic going into and coming out of an Amazon VPC subnet, you can use security groups. Security groups act as virtual firewalls at the instance level, allowing you to specify rules that control inbound and outbound traffic. They operate at the instance level, controlling traffic at the network level. The other options are also related to security, but they serve different purposes: B. AWS WAF (Web Application Firewall): Focuses on protecting web applications from common web exploits. C. AWS Firewall Manager: Manages the AWS WAF settings across your accounts and applications. D. Network ACL (Access Control List): An optional layer of security for your VPC that acts as a firewall for controlling traffic at the subnet level. While it’s a viable option, security groups are often more straightforward for basic traffic control.
  10. MAKI1619 👍 2
    Firewall Manager provides these benefits: Helps to protect resources across accounts Helps to protect all resources of a particular type, such as all Amazon CloudFront distributions Helps to protect all resources with specific tags Automatically adds protection to resources that are added to your account Allows you to subscribe all member accounts in an AWS Organizations organization to AWS Shield Advanced, and automatically subscribes new in-scope accounts that join the organization Allows you to apply security group rules to all member accounts or specific subsets of accounts in an AWS Organizations organization, and automatically applies the rules to new in-scope accounts that join the organization Lets you use your own rules, or purchase managed rules from AWS Marketplace
  11. BShelat 👍 2 Answered C
    NACL, Security Groups and AWS WAF are all firewalls. AWS Firewall Manager service can be used as a central configuration and setup tool to mange all those firewalls scattered around your distributed environment having multiple VPC foot print. Hence the answer is "C". "Why go beyond NACL and Security Groups for ingress traffic filtering" section on the third link explains this concepts better. https://docs.aws.amazon.com/waf/latest/developerguide/fms-chapter.html https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html https://aws.amazon.com/blogs/networking-and-content-delivery/design-your-firewall-deployment-for-internet-ingress-traffic-flows/
  12. Nilupul21 👍 2
    Correct answer is NACL Security Group is used for setup inbound and outbound rules in instance levels not in subnet levels. The question ask for a service or tool which serves at subnet levels. So, this answer is not correct. NACL: Allows to setup rules at subnet levels. So this is the correct answer. Firewall Manager: This is used for a broader perspective. It simplifies administration and maintenance tasks across multiple AWS accounts for variety of protections like WAF, Shield, Security Groups and Network Firewall etc.
  13. tqiu654 👍 2 Answered D
    GPT: To set up a firewall to control traffic going into and coming out of an Amazon VPC subnet, the most appropriate AWS service or tool is: D. Network ACL (Network Access Control List): Network ACLs act as a firewall for controlling traffic into and out of subnets within an Amazon VPC. They provide a layer of security at the subnet level by allowing you to specify both inbound and outbound traffic rules. These rules can allow or deny traffic based on protocol, source IP address, destination IP address, and port number.
  14. geloNSE 👍 2 Answered D
    Since we are on a subnet level, D is the correct answer. Network ACLs allow or deny inbound and outbound traffic at the subnet level. Security groups allow inbound and outbound traffic for associated resources, such as EC2 instances. https://docs.aws.amazon.com/vpc/latest/userguide/infrastructure-security.html#VPC_Security_Comparison
  15. isaphiltrick 👍 2 Answered A
    "A security group acts as a firewall that controls the traffic allowed to and from the resources in your virtual private cloud (VPC). You can choose the ports and protocols to allow for inbound traffic and for outbound traffic." Reference: https://docs.aws.amazon.com/vpc/latest/userguide/security-groups.html
  16. salthehash 👍 2 Answered A
    To control traffic going into and coming out of an Amazon Virtual Private Cloud (VPC) subnet, you can use a combination of security groups and network access control lists (Network ACLs). However, specifically for setting up a firewall-like control at the instance level, you would use security groups.
  17. nani12e434 👍 2
    If the focus is solely on "setting up a firewall for a VPC subnet," Network ACLs (NACLs) are technically the mechanism you'd use. However, if the question is interpreted as "which AWS tool could manage such configurations on a broader scale," AWS Firewall Manager becomes a relevant answer.
  18. juneslayer 👍 2 Answered D
    A network access control list (ACL) allows or denies specific inbound or outbound traffic at the subnet level. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
  19. ChhatwaniB 👍 2
    Answer D : Network Access Control Lists (NACLs) Act as a firewall to control traffic at the subnet level, allowing or denying specific inbound or outbound traffic.
  20. db97 👍 2 Answered D
    Network ACL: Traffic control to the VPC Security Group: Traffic control to the EC2 instance. Answer in this case is "D". Network ACL.
  21. jazkhan 👍 2 Answered D
    https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
  22. Taku2023 👍 2
    AWS firewall Manager has nothing to do with VPC subnets
  23. Sreeni_A 👍 2
    D is correct . AWS Subnet level - AWS Direct Connect
  24. Sreeni_A 👍 2
    D is correct . AWS Subnet level - Network ACLS
  25. MarkDillon1075 👍 2 Answered D
    D - Subnet level, not instance level

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which migration strategies move a cloud-incompatible CMS with least effort?

S-grade

Launching Third-Party IDS in AWS

S-grade

Which AWS Support Plan Offers API Access Most Cost-Effectively?

S-grade

S3 Express One Zone for Single-Digit Millisecond Latency

S-grade

Practice All CLF-C02 Questions

Access 120 questions with complete answers and detailed explanations.

View Full CLF-C02 Practice Test →

← Back to CLF-C02 Study Guide