An optional subnet-level firewall in AWS. It evaluates rules in numeric order and can allow or deny traffic. Stateless: inbound and outbound rules are independent, so you must define both explicitly.
The key difference from security groups on SAA-C03: NACLs are stateless (you must define both inbound AND outbound rules), operate at the subnet level, and can explicitly deny traffic. Useful for blocking specific IPs. Default: allows all traffic.
NACL (Network Access Control List) is a concept that can show up on the exam. Check the full guide to see it in context.