Which AWS networking constructs accept IP address ranges specified using CIDR notation? (Choose two.)

Security groups and network access control lists (network ACLs) both use CIDR notation to define IP address ranges for inbound and outbound traffic rules. Security groups act as virtual firewalls for EC2 instances, controlling traffic at the instance level. Network ACLs operate at the subnet level, providing a stateless firewall that controls traffic entering and exiting subnets. Amazon Machine Images (AMIs) are templates for EC2 instances and do not involve networking rules. AWS Budgets is a cost management tool. Amazon Elastic Block Store (Amazon EBS) provides block storage volumes for EC2 instances and does not directly manage network traffic rules using CIDR.