a) allow/deny, subnet level
NACLs allow/deny traffic on the subnet level. Video for reference: Elastic Cloud Compute Instances Part 2