Question

A solutions architect deploys a web server in a public subnet. The security group allows inbound HTTPS (port 443) from 0.0.0.0/0, but has no outbound rules configured other than the default allow-all. The network ACL for the subnet allows inbound traffic on port 443 but only allows outbound traffic on ports 80 and 443. Clients report that HTTPS requests to the web server time out and never receive a response. What is the most likely cause?

Accepted Answer

The network ACL is blocking return traffic because it does not allow outbound ephemeral ports (1024-65535) used for responses.

Answer

The security group is stateless and requires an explicit outbound rule to allow the HTTPS response back to clients.

Answer

The network ACL must have an inbound rule for ephemeral ports to receive the client's initial connection request.

Answer

The security group inbound rule should reference the network ACL to synchronize allowed ports.