You are evaluating the security setting within the main company vpc. There are several nacls and security groups to evaluate and possibly edit. What is true regarding nacls and security groups?