There are two firewall layers inside a VPC: Security Group (SG) and Network ACL (NACL). Failing to precisely distinguish these two concepts blocks progress on exams and real-world troubleshooting alike. Questions like "Why doesn''t the response come back even though SG is wide open?" or "I opened inbound in NACL but why isn''t communication working?" almost always stem from missing the difference between stateful and stateless.
Today we clarify these concepts from first principles. We''ll cover evaluation order, state tracking differences, and the most common real-world troubleshooting scenarios. This is a core topic tested in nearly every SCS-C03 Domain 3 iteration.