CLF-C02 Security and Compliance Practice Question
A company is deploying a three-tier web application on AWS. The security team requires a network-level firewall that operates at the subnet level and can evaluate both inbound and outbound traffic using stateless rules. Which AWS feature should the company use to meet this requirement?
⚠ Common exam trap
A common mix-up: candidates confuse stateful security groups (which automatically track connection state) with stateless network ACLs, leading candidates to choose Security Groups when the question explicitly requires stateless, subnet-level filtering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network ACLs
Network ACLs (NACLs) are a stateless, subnet-level firewall that evaluates both inbound and outbound traffic based on numbered rules. Unlike security groups, NACLs do not maintain connection state, so rules must be explicitly defined for both directions, meeting the requirement for stateless inspection at the subnet boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Groups
Why it's wrong here
Security Groups act as a virtual firewall at the instance or Elastic Network Interface (ENI) level, and they are stateful, automatically allowing return traffic for permitted inbound connections. They support only allow rules (no explicit deny) and cannot be attached to a subnet to filter all traffic traversing it. In a three-tier architecture, each tier's instances would need separate security groups, whereas a Network ACL provides a single rule set for the entire subnet.
When this WOULD be correct
A question asks for an instance-level firewall that automatically allows return traffic (stateful) and requires no explicit outbound rules for responses. Security Groups would be the correct choice.
- ✓
Network ACLs
Why this is correct
Network ACLs are a stateless firewall operating at the subnet level, supporting both inbound and outbound rules. They evaluate traffic based on rule order and allow or deny traffic without maintaining connection state, matching the requirement.
- ✗
AWS WAF
Why it's wrong here
AWS WAF is a web application firewall that works at Layer 7 to protect against common web exploits. It does not provide subnet-level network firewall capabilities and is not designed for general network traffic control.
When this WOULD be correct
A company needs to protect a web application from common web exploits like SQL injection or cross-site scripting (XSS) by filtering HTTP/HTTPS requests to an Application Load Balancer or CloudFront distribution.
- ✗
AWS Shield
Why it's wrong here
AWS Shield is a managed DDoS protection service that operates at the network and transport layers, primarily defending against volumetric and protocol-based attacks. It does not provide granular subnet-level filtering with the ability to define inbound and outbound rules, nor does it evaluate traffic based on rule order. Shield can be deployed globally (Standard) or on specific resources (Advanced), but it never acts as a stateful or stateless firewall for network traffic control.
When this WOULD be correct
A company needs to protect its web application from DDoS attacks and requires always-on detection and automatic inline mitigations to minimize application downtime. AWS Shield Standard or Advanced would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Network ACLsCorrect answer▾
Why this is correct
Network ACLs are a stateless firewall operating at the subnet level, supporting both inbound and outbound rules. They evaluate traffic based on rule order and allow or deny traffic without maintaining connection state, matching the requirement.
✗Security GroupsWrong answer — click to see why▾
Why this is wrong here
Security Groups operate at the instance level, not the subnet level, and use stateful rules, whereas the requirement specifies a subnet-level, stateless firewall.
★ When this WOULD be the correct answer
A question asks for an instance-level firewall that automatically allows return traffic (stateful) and requires no explicit outbound rules for responses. Security Groups would be the correct choice.
Why candidates choose this
Candidates often confuse Security Groups with Network ACLs because both are firewalls, but they forget that Security Groups are stateful and instance-level, not subnet-level and stateless.
✗AWS WAFWrong answer — click to see why▾
Why this is wrong here
AWS WAF is a web application firewall that operates at Layer 7 (application layer) and uses stateful rules to inspect HTTP/HTTPS traffic, not a network-level firewall at the subnet layer with stateless rules.
★ When this WOULD be the correct answer
A company needs to protect a web application from common web exploits like SQL injection or cross-site scripting (XSS) by filtering HTTP/HTTPS requests to an Application Load Balancer or CloudFront distribution.
Why candidates choose this
Candidates may confuse 'firewall' with 'web application firewall' (WAF) and overlook the specific requirements for network-level, stateless, subnet-level filtering.
✗AWS ShieldWrong answer — click to see why▾
Why this is wrong here
AWS Shield is a managed DDoS protection service, not a network-level firewall. It does not operate at the subnet level or provide stateless rule evaluation for inbound and outbound traffic.
★ When this WOULD be the correct answer
A company needs to protect its web application from DDoS attacks and requires always-on detection and automatic inline mitigations to minimize application downtime. AWS Shield Standard or Advanced would be the correct answer.
Why candidates choose this
Candidates may confuse AWS Shield as a firewall because it provides traffic filtering and protection, but it is specifically for DDoS mitigation, not general network access control.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer needs to apply network traffic filtering rules at the subnet level rather than the instance level. The solution must be stateless and must explicitly define both inbound and outbound rules, including allowing return traffic. Which AWS feature provides subnet-level stateless traffic control?
medium- A.Security groups
- ✓ B.Network Access Control Lists (NACLs)
- C.AWS WAF
- D.VPC route tables
Why B: Network Access Control Lists (NACLs) are the correct choice because they operate at the subnet level, are stateless (meaning they do not automatically allow return traffic), and require explicit inbound and outbound rules. This matches the requirement for stateless traffic filtering where both directions must be defined separately, including rules for return traffic.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.