A web server sits in a subnet protected by both a security group and the default network ACL. An inbound rule on the security group allows TCP 443 from 0.0.0.0/0. No outbound rule was added to the security group. What happens to the server's response traffic on port 443?
- The response is blocked because there is no matching outbound security group rule
- The response is automatically allowed because security groups are stateful and track connections
- The response is allowed only because the default NACL allows all traffic
- The response requires an explicit outbound rule permitting ephemeral ports back to the client
Correct answer: B. The response is automatically allowed because security groups are stateful and track connections
Security groups are stateful: once an inbound connection is permitted, the corresponding return traffic is automatically allowed regardless of outbound rules, so no outbound rule is needed for the reply to a permitted inbound request (this rules out A and D, which describe stateless firewall behavior, not security group behavior). Option C is a distractor that conflates two independent layers: even though the default NACL does happen to allow all traffic both ways, this question is specifically about the security group layer, which behaves statefully on its own regardless of what the NACL does. Network ACLs, by contrast, are stateless and would require explicit rules for both the request and the reply direction. Confusing these two mechanisms, and assuming security groups need matching outbound rules for return traffic, is one of the most commonly tested VPC misconceptions.
Source: AWS VPC docs: Security groups vs network ACLs comparison table