Which AWS service or feature offers security for a VPC by acting as a firewall to control traffic in and out of subnets?

Explanations:

AWS Security Hub is a centralized service for managing security across AWS accounts. It provides security insights but does not act as a firewall for controlling VPC traffic.

Security groups act as virtual firewalls for EC2 instances, controlling inbound and outbound traffic at the instance level, not at the subnet level.

Network ACLs (Access Control Lists) provide a firewall-like feature at the subnet level to control both inbound and outbound traffic for a VPC, making it the correct answer.

AWS WAF (Web Application Firewall) protects web applications from common web exploits but is not used for controlling traffic to and from VPC subnets.