Correct Answer: An outbound rule for ephemeral ports (e.g., 1024-65535) back to the client
NACLs are stateless. You must explicitly allow the 'returning' traffic from the server to the client's temporary (ephemeral) port range....
Correct Answer
An outbound rule for ephemeral ports (e.g., 1024-65535) back to the client
Why This Answer Is Correct
NACLs are stateless. You must explicitly allow the 'returning' traffic from the server to the client's temporary (ephemeral) port range.
This question evaluates your knowledge of Network ACLs — a core concept tested in AWS Certified Solutions Architect – Associate (SAA-C03). Understanding Network ACLs is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
You need to explicitly deny traffic from a specific IP address to your Amazon EC2 instances. Can Security Groups natively handle explicit deny rules?
You need stateless firewall rules at the subnet level in your Amazon VPC. What should you configure?
What is the 'Default' behavior of a Network ACL created by a user (not the VPC default NACL)?
Can a Network ACL be associated with multiple subnets in the same VPC?
Which security layer acts as a 'second line of defense' at the subnet level in an AWS VPC?