Clients time out reaching a university web tier on port 443. The instance security group allows 443 from the internet, and the subnet NACL allows inbound 443. Return traffic never leaves. Which change matches that symptom?
Select an answer to reveal the explanation.
Short Explanation
A network ACL is a turnstile that checks you in both directions. The request got in on 443, and the reply uses a high port the ACL never allowed out, so the conversation dies. You open those return ports on the NACL, because the security group was already doing its half.
Full Explanation
Network ACLs are stateless. An inbound allow for 443 does not permit the response, which leaves from an ephemeral port toward the client. If that outbound range is missing, clients time out even though the security group, which is stateful, already allows 443. Allowing the ephemeral range outbound on the NACL restores the return path. Opening SSH does not create the missing return rule and widens admin access. A VPC has one internet gateway, and a second one is not the missing piece when 443 already arrives. Cross-zone load balancing changes how an Application Load Balancer spreads traffic across zones; it does not repair a NACL. Caveat: lock the ephemeral range to what the clients actually use, and keep the NACL's rule numbers in an order that hits the allow before a broad deny. Operational check: after the outbound allow, a connection from outside should complete, and a flow log should show the return as ACCEPT. Ephemeral ports are the high source ports the server uses on the way back to the client, often in the range above 1024. A NACL rule is numbered, and a lower number wins, so the new allow has to sit above the broad deny or it never matches. Security groups do not need this return rule because they remember the connection.