A solutions architect is designing the network security for a three-tier web application in a VPC. The architect needs to implement security controls at the subnet level and the instance level.<br/><br/>Which TWO statements about VPC security are correct? (Select TWO.)

Security groups are stateful, meaning return traffic is automatically allowed.

Network ACLs are stateful, meaning return traffic is automatically allowed.

Security groups operate at the subnet level.

Network ACLs are stateless, meaning return traffic must be explicitly allowed.

Security groups evaluate all rules before deciding to allow traffic.