Exercise 1: Security Groups vs. Network ACLs — Possible Solution
====================================================================

What each applies to:

A SECURITY GROUP applies to an individual instance or resource --
per the chapter, it's attached directly to the specific thing being
protected. A NETWORK ACL applies to an entire SUBNET -- every resource
within that subnet is subject to the same NACL rules, regardless of
which individual instance it is.

Stateful vs. stateless:

Security groups are STATEFUL. Network ACLs are STATELESS.

Why "return traffic is automatically allowed" is true for one but not
the other:

A stateful firewall (the security group) tracks the CONNECTION itself,
not just individual packets in isolation. If an inbound rule permits a
request in, the security group automatically recognizes the
corresponding RESPONSE traffic going back out as part of that same,
already-permitted connection -- no separate outbound rule is needed
for the reply.

A stateless firewall (the NACL) has no concept of an ongoing
connection at all -- it evaluates every single packet independently
against its rule list, in both directions. This means an inbound
request being allowed in says NOTHING about whether the corresponding
OUTBOUND response packet will also be allowed -- that has to be
permitted by a SEPARATE, explicit outbound rule, or the response never
makes it back out even though the original request got in.

WHY THIS WORKS AS AN ANSWER
------------------------------
This directly explains the mechanism behind the chapter's own
comparison table rather than just restating "stateful vs. stateless"
as labels -- the practical consequence (does a reply need its own
rule, or not) is exactly why the chapter's warn-box flags checking
only one of the two as a common, real mistake: a NACL missing an
outbound rule can silently break a connection that the security group
alone would have allowed just fine.