Which AWS Tool Acts as a Firewall for a VPC Subnet?
Answer
Correct answer: D — A network ACL acts as the subnet-level firewall that allows or denies traffic entering and leaving an Amazon VPC subnet.
Which AWS service or tool can be used to set up a firewall to control traffic going into and coming out of an Amazon VPC subnet?
Community Insight
The question tests scope mapping (subnet vs. instance vs. web application) against centrally managed policy tools, and the trap is treating the phrase "service or tool" as a hint for AWS Firewall Manager.
Network ACLs are the stateless, subnet-level firewall layer in Amazon VPC that evaluates numbered allow and deny rules for traffic entering and leaving a subnet. This page establishes why a network ACL — not a security group, AWS WAF, or AWS Firewall Manager — is the correct answer here.
Picking AWS Firewall Manager because the stem says "service or tool," or picking security groups, which enforce stateful allow-only rules at the ENI/instance level rather than at the subnet boundary.
Community Discussion (61 comments)
discojc
👍 1
Selected: D
It is Network ACL. NACLs operate at subnet level. You are wanting traffic to go into and out of a subnet. Firewall manager centrally manages firewall rules (like WAF), it is not a firewall mechanism.
Hokage25
👍 1
Selected: C
Read carefully its`s a TRAP : "control traffic going into and coming out of an Amazon VPC subnet" - NOT AT SUBNET LEVEL in my opinion it means that - control traffic at higher level that VPC subnet. My answer is C - AWS Firewall manager My explanation: network (ACL) allows or denies specific inbound or outbound traffic AT THE subnet level
6ce3034
👍 1
Selected: D
The correct answer is: D. Network ACL Explanation: A Network Access Control List (Network ACL) is a security layer at the subnet level that controls inbound and outbound traffic for Amazon VPC. It acts as a firewall for controlling traffic going in and out of subnets, providing stateless filtering based on rules.
Hokage25
👍 1
You are wrong - read carefully question and your explanation. The trick is in the question - and coming out (of an Amazon VPC subnet) "OF AN VPC Subnet" - it means that is over subnet. As you answer - Network (ACL) - security layer (AT THE) subnet level. - it mean it is in subnet
Smile03
👍 1
Selected: D
A: Security group acts as a virtual firewall for your EC2 instances to control incoming and outgoing traffic. Inbound rules control the incoming traffic to your instance, and outbound rules control the outgoing traffic from your instance. When you launch an instance, you can specify one or more security groups. If you don't specify a security group, Amazon EC2 uses the default security group for the VPC. After you launch an instance, you can change its security groups. C: Your VPC automatically comes with a modifiable default network ACL. By default, it allows all inbound and outbound IPv4 traffic and, if applicable, IPv6 traffic. You can create a custom network ACL and associate it with a subnet to allow or deny specific inbound or outbound traffic at the subnet level.
Amin_013
👍 1
Selected: D
Network ACLs are used to control inbound and outbound traffic at the subnet level within an Amazon VPC. They provide a way to set up a firewall that operates at the network layer and are applied to all instances within a subnet.
SrikanthNL
👍 1
Selected: C
TOOL, FIREWALL MANAGER = TOOL and is superset of NACL
ShaiTay
👍 1
Selected: D
D. Network ACL - key word is subnet
Kilobay1
👍 1
Selected: D
Network ACLs are used to control inbound and outbound traffic at the subnet level within an Amazon VPC. They provide a way to set up a firewall that operates at the network layer and are applied to all instances within a subnet.
EvilBeaver
👍 1
Selected: D
As stated in the question, we're looking for a mechanism to control the subnet traffic, so it's a NACL.
ChhatwaniB
👍 2
Answer D : Network Access Control Lists (NACLs) Act as a firewall to control traffic at the subnet level, allowing or denying specific inbound or outbound traffic.
geocis
👍 1
Selected: D
Like Pietro167 stated Network ACL = Subnet | Security Groups = Instances
Val2344
👍 3
Selected: D
The correct answer is D. Network ACL (Access Control List). Network ACLs act as a firewall for controlling traffic in and out of a subnet in Amazon Virtual Private Cloud (VPC). They operate at the subnet level and evaluate traffic based on rules defined for inbound and outbound traffic.
pqd
👍 1
ACL = sub-rede, grupos de segurança = instâncias (by pietro167) Perfect
chalaka
👍 1
Selected: D
D. Network ACL (Access Control List) Network ACLs act as a firewall for controlling traffic at the subnet level. They are stateless and operate at the subnet level, allowing or denying traffic based on rules defined for inbound and outbound traffic. Network ACLs provide an added layer of security by allowing you to specify rules that govern traffic at the network level, complementing the security groups that operate at the instance level.
Gallileo9
👍 1
Selected: D
Network ACL
Nilupul21
👍 2
Correct answer is NACL Security Group is used for setup inbound and outbound rules in instance levels not in subnet levels. The question ask for a service or tool which serves at subnet levels. So, this answer is not correct. NACL: Allows to setup rules at subnet levels. So this is the correct answer. Firewall Manager: This is used for a broader perspective. It simplifies administration and maintenance tasks across multiple AWS accounts for variety of protections like WAF, Shield, Security Groups and Network Firewall etc.
homodeus
👍 1
They phrase is "...to control traffic going into and coming out of an Amazon VPC subnet?". It is NACL. D
MarysSon
👍 3
Selected: C
C is the correct answer. The AWS Firewall Manager helps to configure a firewall and that’s what this question is asking. ”AWS Firewall Manager simplifies your AWS WAF administration and maintenance tasks across multiple accounts and resources. With AWS Firewall Manager, you set up your firewall rules just once.” A – Security groups are essential to efficiently managing access to resources, but they are not classified as a service. B – Web application firewall is essential to controlling traffic into and out of a network, by setting access rules and monitoring network request, but this is not the best answer. D – Access Control Lists are used to grant or limit access to network and system resources, but they are not classified as a service. Reference: https://AWS Firewall Manager Documentation (amazon.com)
bd29
👍 1
Selected: A
A. Security Group is the primary method.
andrei97
👍 1
To set up a firewall to control traffic going into and coming out of an Amazon VPC (Virtual Private Cloud) subnet, you can use AWS Network Firewall. AWS Network Firewall is a managed service that makes it easy to deploy essential network protections for your VPCs. It allows you to create firewall rules and enforce them at the perimeter of your VPC. With AWS Network Firewall, you can define rules based on IP addresses, ports, protocols, and other criteria to allow or deny traffic. It integrates with AWS Firewall Manager for centralized management across multiple accounts and VPCs. C - correct By using AWS Network Firewall, you can effectively control inbound and outbound traffic to and from your VPC subnets, enhancing the security posture of your AWS infrastructure.
LinuxChamp
👍 1
D = CORRECT
Ruffyit
👍 1
D. Network ACL (Access Control List): An optional layer of security for your VPC that acts as a firewall for controlling traffic at the subnet level. While it’s a viable option, security groups are often more straightforward for basic traffic control.
OZGEGOKCHE
👍 2
Selected: A
A. Security group To control traffic going into and coming out of an Amazon VPC subnet, you can use security groups. Security groups act as virtual firewalls at the instance level, allowing you to specify rules that control inbound and outbound traffic. They operate at the instance level, controlling traffic at the network level. The other options are also related to security, but they serve different purposes: B. AWS WAF (Web Application Firewall): Focuses on protecting web applications from common web exploits. C. AWS Firewall Manager: Manages the AWS WAF settings across your accounts and applications. D. Network ACL (Access Control List): An optional layer of security for your VPC that acts as a firewall for controlling traffic at the subnet level. While it’s a viable option, security groups are often more straightforward for basic traffic control.
TheFivePips
👍 5
Selected: D
A. Security group: Acts as a virtual firewall for an Amazon EC2 instance. It controls inbound and outbound traffic at the instance level. While it's an essential component for controlling traffic to and from EC2 instances, it operates at the instance level, not at the subnet level. B. AWS WAF (Web Application Firewall): Focused on protecting web applications from common web exploits. It is used for filtering HTTP traffic and is not designed to control traffic at the VPC subnet level. C. AWS Firewall Manager: A service that helps manage AWS WAF rules across multiple accounts and resources. It is more about central configuration and management of WAF rules, rather than directly controlling traffic at the VPC subnet level. D. Network ACL (Access Control List): A set of rules that control inbound and outbound traffic at the subnet level. It operates at the network layer (Layer 3) and allows or denies traffic based on defined rules for a specific subnet. Network ACLs provide control over traffic entering and leaving a subnet within an Amazon VPC.
reachmevisa
👍 1
D Network ACL https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
Travisnica
👍 4
Selected: C
The question says "what service or tool can be used to set up a firewall" so C is the correct answer. It's known that VPC subnet must be associated with a network ACL. However, to set up the firewall you will use AWS Firewall Manager.
Taku2023
👍 1
AWS Firewall Manager is a security management service that allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations.
BShelat
👍 2
Selected: C
NACL, Security Groups and AWS WAF are all firewalls. AWS Firewall Manager service can be used as a central configuration and setup tool to mange all those firewalls scattered around your distributed environment having multiple VPC foot print. Hence the answer is "C". "Why go beyond NACL and Security Groups for ingress traffic filtering" section on the third link explains this concepts better. https://docs.aws.amazon.com/waf/latest/developerguide/fms-chapter.html https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html https://aws.amazon.com/blogs/networking-and-content-delivery/design-your-firewall-deployment-for-internet-ingress-traffic-flows/
jazkhan
👍 2
Selected: D
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
Penny357
👍 10
Selected: C
The Question states "AWS service or tool can be 'used' to set up a firewall" So option is C. And Network ACL is not a AWS service or tool. Correct me if i am wrong.
nani12e434
👍 2
If the focus is solely on "setting up a firewall for a VPC subnet," Network ACLs (NACLs) are technically the mechanism you'd use. However, if the question is interpreted as "which AWS tool could manage such configurations on a broader scale," AWS Firewall Manager becomes a relevant answer.
Taku2023
👍 2
AWS firewall Manager has nothing to do with VPC subnets
BShelat
👍 4
You are right. NACL is a list of rules. It is not a tool "to setup and manage" firewall. AWS Firewall Manager is a tool to setup, configure and manage AWS WAF and AWS Shield .
Rahul_Ghai
👍 1
The term Service is a broader classification. The key point is that Network Access Control List acts as a firewall to secure virtual private clouds (VPCs) and subnets. NACLs control and manage traffic in subnets
Anuj08
👍 4
Selected: D
Security groups and network ACLs are similar in that they allow you to control access to AWS resources within your VPC. But security groups allow you to control inbound and outbound traffic at the instance level, while network ACLs offer similar capabilities at the VPC subnet level.
salthehash
👍 2
Selected: A
To control traffic going into and coming out of an Amazon Virtual Private Cloud (VPC) subnet, you can use a combination of security groups and network access control lists (Network ACLs). However, specifically for setting up a firewall-like control at the instance level, you would use security groups.
VikJo1978
👍 2
The answer is A, Security Groups.
pietro167
👍 51
Selected: D
ACL = subnet, Security Groups = instances
reddy187
👍 2
Correct : KeyWOrd: Subnet
db97
👍 2
Selected: D
Network ACL: Traffic control to the VPC Security Group: Traffic control to the EC2 instance. Answer in this case is "D". Network ACL.
Fulmi
👍 3
Selected: D
ACL = subnet, Security Groups = instances
SanePebble
👍 3
Selected: D
Key word is subnet
cloudrishank
👍 2
Selected: D
Nacl is at subnet level
tqiu654
👍 2
Selected: D
GPT: To set up a firewall to control traffic going into and coming out of an Amazon VPC subnet, the most appropriate AWS service or tool is: D. Network ACL (Network Access Control List): Network ACLs act as a firewall for controlling traffic into and out of subnets within an Amazon VPC. They provide a layer of security at the subnet level by allowing you to specify both inbound and outbound traffic rules. These rules can allow or deny traffic based on protocol, source IP address, destination IP address, and port number.
rankocertified
👍 3
Selected: D
Cannot be C: AWS Firewall Manager is a security management service that allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations. As new applications are created, Firewall Manager makes it easier to bring new applications and resources into compliance by enforcing a common set of security rules. therefore the only valid answer is D as it pertains to subnets (VPC)
FMORADELL
👍 1
Selected: A
Security groups act as a virtual firewall for your instances, controlling inbound and outbound traffic at the instance level in an Amazon VPC. They are the most appropriate choice for controlling traffic within a subnet.
Mohamedsadat
👍 2
Selected: D
D because it out of VPC
Blik
👍 2
Selected: D
SUBNET = NETWORK ACL
EssentialD
👍 2
Selected: D
subnet --> Network ACLs
Sreeni_A
👍 2
D is correct . AWS Subnet level - Network ACLS
Sreeni_A
👍 2
D is correct . AWS Subnet level - AWS Direct Connect
asdfcdsxdfc
👍 3
Selected: D
D is correct
MAKI1619
👍 2
Firewall Manager provides these benefits: Helps to protect resources across accounts Helps to protect all resources of a particular type, such as all Amazon CloudFront distributions Helps to protect all resources with specific tags Automatically adds protection to resources that are added to your account Allows you to subscribe all member accounts in an AWS Organizations organization to AWS Shield Advanced, and automatically subscribes new in-scope accounts that join the organization Allows you to apply security group rules to all member accounts or specific subsets of accounts in an AWS Organizations organization, and automatically applies the rules to new in-scope accounts that join the organization Lets you use your own rules, or purchase managed rules from AWS Marketplace
nocinfra
👍 4
Selected: D
Network ACLs are an optional layer of security that act as a firewall for controlling inbound and outbound traffic at the subnet level. https://docs.aws.amazon.com/zh_tw/vpc/latest/userguide/VPC_Security.html#VPC_Security_Comparison
geloNSE
👍 2
Selected: D
Since we are on a subnet level, D is the correct answer. Network ACLs allow or deny inbound and outbound traffic at the subnet level. Security groups allow inbound and outbound traffic for associated resources, such as EC2 instances. https://docs.aws.amazon.com/vpc/latest/userguide/infrastructure-security.html#VPC_Security_Comparison
MarkDillon1075
👍 2
Selected: D
D - Subnet level, not instance level
juneslayer
👍 2
Selected: D
A network access control list (ACL) allows or denies specific inbound or outbound traffic at the subnet level. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
Anyio
👍 3
Selected: A
The correct answer is A. A security group acts as a firewall that controls the traffic allowed to and from the resources in your virtual private cloud (VPC). You can choose the ports and protocols to allow for inbound traffic and for outbound traffic. https://docs.aws.amazon.com/vpc/latest/userguide/security-groups.html
Derpowsky
👍 1
Wrong, the security group works at the instance level, not the subnet level. The packet will never reach the security group if it doesn't pass through ACL.
isaphiltrick
👍 2
Selected: A
"A security group acts as a firewall that controls the traffic allowed to and from the resources in your virtual private cloud (VPC). You can choose the ports and protocols to allow for inbound traffic and for outbound traffic." Reference: https://docs.aws.amazon.com/vpc/latest/userguide/security-groups.html
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A network ACL is exactly what AWS documents as the optional security layer that "acts as a firewall for controlling traffic in and out of one or more subnets." It attaches to a subnet, evaluates numbered rules in order, supports both allow and deny statements, and is stateless — which is why return traffic must be explicitly permitted by the outbound and inbound rule sets. The stem's wording, "traffic going into and coming out of an Amazon VPC subnet," is the textbook definition of a network ACL's job, so D is the direct scope match. No other option in the list operates at the subnet boundary with allow/deny evaluation.Why the Other Options Are Wrong
A security group is a virtual firewall for an instance or elastic network interface, is stateful, and only supports allow rules, so it cannot filter an entire subnet. AWS WAF is a Layer 7 web application firewall that inspects HTTP(S) requests in front of CloudFront, Application Load Balancer, API Gateway, or AppSync — it does not govern arbitrary VPC subnet traffic. AWS Firewall Manager is a central administration service that deploys and maintains AWS WAF, Shield Advanced, security group, and Network Firewall policies across accounts in AWS Organizations; it manages firewall configuration, it is not the subnet-level filter being described. The phrase "service or tool" is generic exam boilerplate and does not convert a management console into the enforcement point.Community Comment Notes
pietro167's shorthand — "ACL = subnet, Security Groups = instances" — captures the scope distinction that most voters used to reach D. Penny357 and Travisnica instead read "service or tool" as pointing to Firewall Manager, with Travisnica writing that "to set up the firewall you will use AWS Firewall Manager"; that reasoning conflates a multi-account policy manager with the filter that actually guards the subnet. BShelat backed that dissent by noting a NACL is "a list of rules" rather than a management tool, while Val2344 and nocinfra returned to AWS's own framing of network ACLs as a subnet firewall and linked the VPC security comparison documentation. The discussion is a useful reminder that CLF-C02 often tests scope words rather than product marketing language.Official Reference
Exam Strategy
When a stem names a scope — subnet, instance, or web application — map that scope to the service before you read the options, then eliminate anything whose enforcement point is elsewhere. Treat phrases like "service or tool" as filler rather than as a clue pointing to a management service such as Firewall Manager.
Frequently Asked Questions
Why isn't AWS Firewall Manager the answer if it sets up firewall rules?
Firewall Manager centrally administers WAF, Shield Advanced, security group, and Network Firewall policies across accounts in AWS Organizations; it does not itself enforce subnet-level allow/deny rules the way a network ACL does.
Can a security group control traffic for an entire VPC subnet?
No. Security groups attach to ENIs and instances and are stateful with allow-only rules; subnet-wide filtering with explicit deny rules requires a network ACL associated with that subnet.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →