Use a network ACL at the subnet boundary to control TCP application traffic.
Allow the client's return traffic through ephemeral ports as well.
Which statement is most appropriate?
Because a network ACL is stateless, add the required ephemeral-port rules in both the inbound and outbound directions.
Detailed explanation
Removing rules does not safely express the required traffic and can deny or expose the subnet unexpectedly.
Removing rules does not safely express the required traffic and can deny or expose the subnet unexpectedly.
Automatic return traffic is a property of stateful security groups, not NACLs.
Automatic return traffic is a property of stateful security groups, not NACLs.
NACLs are associated with subnets rather than individual ENIs.
NACLs are associated with subnets rather than individual ENIs.
A stateless NACL evaluates each direction separately, so return traffic needs its own matching rule.
A stateless NACL evaluates each direction separately, so return traffic needs its own matching rule.
Check official documentation
Compare the following points with the official documentation.
VPC Network ACLのステートレスな動作を確認する。
What to confirm
NACLとSecurity Groupの状態保持の違いを説明できる。
Key points
- Network ACL
- Stateless
- Ephemeral port
Notes
- Environment: AWS公式VPCドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Bidirectional rules
A stateless NACL needs matching rules for request and return paths.
Scope
NACLs protect subnets, while security groups protect resources and track connection state.