This will come up.
| Feature | Security Group | NACL |
|---|---|---|
| Operates at | Instance / ENI level | Subnet level |
| Stateful? | Yes | No |
| Rules | Allow only | Allow and deny |
| Default | Deny all inbound, allow all outbound | Allow all inbound and outbound |
| Order of rules | All rules evaluated | Numbered, evaluated in order |
Stateful means: if you allow inbound traffic, the return outbound is automatically allowed. Security groups remember the connection. NACLs don't — you must allow both directions explicitly.
Crisp answer: "Security groups are stateful and operate at the instance level — if I allow inbound on port 443, the return traffic is automatically allowed. NACLs are stateless and operate at the subnet level — I have to write rules for both directions. Security groups can only allow; NACLs can allow and deny. Most network issues are easier to debug with security groups; NACLs are useful as a coarse-grained extra layer at the subnet boundary."