Option C is incorrect under the HCIA-Cloud Service V3.5 networking model. Huawei Cloud's V3.5-era VPC documentation differentiates the two access-control mechanisms by their scope and rule behavior: security groups protect cloud server instances and use allow rules, whereas network ACLs protect subnets and support both allow and deny rules. Therefore, the statement that both mechanisms support both rule actions is inconsistent with the curriculum version used by this examination.

Option A is correct because a network ACL is associated with one or more subnets and controls traffic entering or leaving those subnets. Option D is also correct because security groups provide instance-level access control for resources such as ECSs. Huawei describes a security group as a collection of traffic-control rules applied to instances sharing common security requirements.

Option B is technically correct because these mechanisms can be layered. A security group provides access control around ECS instances, while a network ACL adds another security-control boundary around the subnet. Huawei specifically recommends using them together where comprehensive or fine-grained network protection is required.

Reference topics: Security Groups; Network ACLs; VPC Access Control; Defense-in-Depth.

===============