SAA-C03 Practice Question 13: NACL Ephemeral Ports

Network ACLs are stateless: return traffic is not automatically allowed, so every flow needs an explicit rule in each direction. A client's request reaches the server on port 443 and passes the inbound rule. The server's response, though, is sent *from* port 443 *to* the client's ephemeral port. The client operating system chooses that port, for example 49152-65535 on modern Windows or 32768-60999 on many Linux kernels. The only outbound rule allows destination port 443, so every response is dropped by the default deny and the connection times out. The fix is an outbound rule that allows the ephemeral range. AWS recommends 1024-65535 to cover all client types, including traffic from Elastic Load Balancing and NAT gateways.

Option A misunderstands security groups. They are stateful, so responses to allowed inbound traffic are always allowed back out, whatever the port. The security group is not what is blocking the traffic.

Option B is redundant for the same reason, and the group's default rule already allows all outbound traffic. Anything you change in the security group leaves the network ACL still blocking the responses.

Option D is the right range in the wrong direction. An inbound ephemeral rule is what you need when the *instance* starts the connection, for example downloading patches from the internet, so that the responses can get back in. For client connections into the web server, the responses leave the subnet, so the missing rule is outbound.

References: Custom network ACLs for your VPC; Control subnet traffic with network access control lists