SOA-C02 Practice Question 9: Network ACL Ephemeral Ports
AWS Certified SysOps Administrator – Associate (SOA-C02) · Test 1 · question 9 of 10
A web server runs on an EC2 instance in a public subnet. Its security group allows inbound TCP 443 from 0.0.0.0/0 and leaves the default allow-all outbound rule in place. A custom network ACL is associated with the subnet with exactly two rules: inbound ALLOW TCP 443 from 0.0.0.0/0 and outbound ALLOW TCP 443 to 0.0.0.0/0. Users report that the site never loads and their browsers eventually time out, although packet captures on the instance show the HTTPS requests arriving.
What change makes the site reachable?
Show answer and explanation
Answer:
Network ACLs are stateless: each direction is evaluated independently, so response packets are not automatically permitted. The request arrives with destination port 443 and matches the inbound rule, which is why the capture shows it. The server's reply, however, is sent to the client's *ephemeral* source port, so it is evaluated against outbound rules for a destination port somewhere in 1024-65535, not 443. With no matching outbound rule, the implicit deny drops every response and the browser times out. Allowing outbound TCP 1024-65535 lets the replies leave.
Option B addresses the wrong direction. Inbound ephemeral ports would be needed for responses to connections the *instance* initiated, not for replies to inbound web requests.
Option C is unnecessary. Security groups are stateful, so the response to an allowed inbound connection is permitted automatically regardless of the rules; the packet captures already prove the security group is not the blocker.
Option D misreads how network ACLs are evaluated. Rules are processed in ascending rule-number order and the implicit deny, shown as rule *, is always last, so any numbered ALLOW rule already precedes it. The outbound rule is being reached; it simply does not match the destination port.
Reference: Control subnet traffic with network access control lists