A cloud web server allows inbound TCP 443, and the matching return traffic is allowed without a separate outbound rule. Which cloud control behaves that way?
Select an answer to reveal the explanation.
Short Explanation
The guard at the door remembers who you let in, so those people can walk back out without a second rule. That memory is a stateful security group. A stateless list forgets the conversation and needs an explicit rule for the return, and a content cache or an empty recovery site does not track this session.
Full Explanation
A security group in the cloud model this exam uses is stateful: when it allows an inbound session, the return traffic for that session is allowed without a matching outbound rule. The web server allows inbound TCP 443 and the replies flow without a separate outbound entry, which is that behavior. A network ACL is stateless. It evaluates each direction on its own, so return traffic needs an explicit rule, typically for the ephemeral ports. The distractor claims the opposite. A content delivery network caches content near users. It does not write the server's inbound rule or track that session. A cold site is space and power for recovery. It does not hold connection state for a web server. Exam caveat: stateful does not mean every port is open. The inbound allow is still required, and an explicit deny or a missing allow still blocks new sessions. Operational check: allow TCP 443 inbound on the security group, confirm a client completes a session, and confirm you did not also have to permit the return ephemeral ports.