What is the difference between a stateful and a stateless firewall? How does that relate to AWS security groups and NACLs?
What they are really testing: Whether you understand connection tracking and why return traffic is automatic in one but must be allowed explicitly in the other. This trips people up on every cloud network design.
A real interview question
What is the difference between a stateful and a stateless firewall? How does that relate to AWS security groups and NACLs?
What most people say
drag me
“Stateful firewalls are smarter and stateless ones are simpler, so security groups are the better choice.”
It frames a behavioral difference as good versus bad. The real point is connection tracking and the ephemeral-port return-traffic gotcha on stateless NACLs, which is missed entirely.
The follow-ups they ask next
You allowed inbound 443 on a NACL but responses fail. Why?
NACLs are stateless: the return traffic leaves on an ephemeral port and is not auto-allowed. Add an outbound rule for 1024-65535 (the ephemeral range).
Why use a NACL at all if security groups are easier?
NACLs apply at the subnet boundary and can explicitly deny, so they are a coarse second layer (for example blocking an IP range) beneath the instance-level security group.
What the interviewer is listening for
- Explains connection tracking
- Maps SG=stateful, NACL=stateless
- Knows the ephemeral-port return-traffic rule
What sinks the answer
- "Stateful is just better"
- Thinks NACLs auto-allow return traffic
- Unaware of ephemeral ports
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“A stateful firewall [tracks connections, so return traffic is auto-allowed, you write one direction]. A stateless one [judges each packet alone, so you allow both directions]. In AWS, [security groups are stateful, NACLs are stateless]. The NACL gotcha: [return traffic uses ephemeral ports 1024-65535, which you must open outbound].”
Keep going with networking
Foundation
What is a VPC, and what is a subnet within it? Why split a network into subnets at all?
Foundation
What is the difference between TCP and UDP, and when would you choose each?
Foundation
What happens, step by step, when you type a URL into a browser and press enter?
Foundation
How does DNS resolution actually work, and what is the difference between an A record and a CNAME?
Foundation
What is the difference between IPv4 and IPv6, and why does IPv6 exist?
Junior
An EC2 instance in a private subnet needs to download OS updates from the internet. Walk me through how you make that work, and why.
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free