CCSP Cloud Platform and Infrastructure Security Practice Question

Which TWO of the following are characteristics of security groups compared to network ACLs in a cloud VPC? (Select two.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Stateful – return traffic is automatically allowed

Security groups are stateful (return traffic allowed) and support only allow rules. NACLs are stateless and support both allow and deny rules.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Operate at the subnet level
Why it's wrong here
Security groups operate at the instance level, not subnet.
✓
Stateful – return traffic is automatically allowed
Why this is correct
Security groups track connection state and allow return traffic.
✗
Stateless – each packet is evaluated independently
Why it's wrong here
This is a characteristic of NACLs, not security groups.
✗
Support both allow and deny rules
Why it's wrong here
Security groups only support allow rules; NACLs support both.
✓
Only allow rules can be specified
Why this is correct
Security groups have implicit deny and allow rules only.

Go deeper