An EC2 instance's security group allows inbound TCP 22 and has had every outbound rule removed. The subnet's network ACL allows inbound TCP 22 and outbound TCP 1024-65535. SSH sessions from administrators still work, and the instance's replies reach them. Which behavior explains why the replies are permitted?

AWS security groups are stateful, instance-level firewalls. When an inbound connection matches an allow rule, the security group records the flow, and response traffic for that connection is permitted automatically regardless of the outbound rules, which is why removing every outbound rule does not break an inbound SSH session. Network ACLs are stateless and are evaluated at the subnet boundary for every packet in each direction. Because the ACL keeps no connection state, the replies from port 22 to the client's ephemeral port must match an explicit outbound allow rule, and the 1024-65535 rule provides it. Traffic must be allowed by both layers; neither one overrides the other, so the idea that an ACL rule trumps the security group is wrong. Security groups are not stateless, and there is no hidden outbound allow-all that survives deleting the rules; the default outbound rule is an ordinary rule that can be removed. Evaluation order is also not the explanation, because a deny at either layer still drops the packet. Exam caveat: an inbound ACL deny on port 22 would block the session even if the security group allowed it. Operational check: review VPC Flow Logs for ACCEPT records in both directions and confirm the ACL's outbound ephemeral range covers the client operating systems in use.