Which statement correctly compares security groups and network ACLs?

Security groups are stateful and only have allow rules. NACLs (network access control lists) are stateless, have allow and deny rules, and apply to a whole subnet.

• A security group works at the network interface level. It is stateful: it remembers allowed connections and lets their return traffic back in automatically. It has no deny rules.
• A NACL works at the subnet level. It is stateless: it does not remember connections. So you must allow return traffic on ephemeral ports (the temporary high ports used for replies) yourself. Its rules are numbered and checked in order, and the first match wins.

"Security groups are stateless … NACLs are stateful" swaps the two. This is the classic mistake. "Both support explicit deny rules" is wrong, because security groups have only allow rules. "NACLs are attached to instances and security groups to subnets" is also swapped.