Which AWS tool or feature acts as a VPC firewall at the subnet level? (CLF-C02)

Correct answer: B) Network ACL.
Network ACLs are stateless packet filters that control inbound and outbound traffic at the subnet level. They operate at the subnet level and can be configured to allow or deny traffic based on IP addresses, ports, and protocols. Network ACLs provide an additional layer of security alongside security groups, allowing you to create customized network access controls to meet your specific security requirements.