CCSP Cloud Platform and Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Security groups are stateless, while NACLs are stateful

  Why it's wrong here

  Security groups are stateful and NACLs stateless, so this reverses the actual behaviour. It tempts because both filter traffic at different VPC layers, and NACLs genuinely are the stateless one — the correct pairing. The stem asks for a key difference, and this inverts the stateful/stateless axis that distinguishes them.

• ✗

  Security groups are applied at the subnet level, while NACLs are applied at the instance level

  Why it's wrong here

  Security groups attach to elastic network interfaces at the instance level and are stateful; NACLs apply at the subnet level and are stateless. The option reverses these, so it fails the stated difference. Security groups suit per-instance control, NACLs suit subnet-wide boundary filtering.

• ✗

  Security groups support both allow and deny rules

  Why it's wrong here

  Security groups are stateful and allow only permit rules; denial is implicit, so they cannot express explicit deny entries. The option inverts NACL behaviour, which does support allow and deny rules. Security groups would be chosen for instance-level stateful filtering, not rule-type differentiation.

• ✓

  Security groups are stateful, while NACLs are stateless

  Why this is correct

  Security groups track connection state, so return traffic is automatically permitted regardless of inbound rules. Network ACLs evaluate each packet independently against their rules, requiring explicit inbound and outbound allowances for both directions of a flow.