NACLs are stateful and automatically track connections; the fix is to add a new inbound rule to the security group for client source ports.

NACLs are stateless; connection tracking occurs at the security group level only. Adding SG inbound rules won’t unblock outbound traffic blocked by the NACL.

The issue is caused by ALB health checks; configure a new target group health check on port 80 so traffic can be routed.

Health checks may affect routing, but the symptom points to NACL blocking return packets. Changing health check ports won’t address NACL stateless behavior.

Because instances are in private subnets, add a NAT gateway so return traffic can reach the internet over dynamic routing.

NAT affects internet egress, not east-west return paths inside the VPC subnet. The observed NACL rule gap is within the subnet path.

What does this SAA-C03 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: NACLs are stateless, so you must update the NACL to allow the return (outbound) ephemeral port range; security groups alone cannot override a blocked NACL. — Security groups are stateful, but network ACLs are stateless. That means a permitted inbound rule on a NACL does not automatically allow the corresponding outbound return traffic. If the NACL allows inbound to destination port 443 but blocks or omits outbound rules for the ephemeral source ports used by clients/ALB, the TCP handshake or response will fail, causing timeouts. Updating the NACL to include the appropriate outbound ephemeral port range (and often matching inbound/outbound rules) resolves the connectivity issue without weakening security group scoping. Why others are wrong: Option B is incorrect because it states NACLs are stateful; NACLs do not track connections. Option C misattributes the failure to health checks; while health checks matter, they don’t bypass NACL stateless filtering. Option D is irrelevant because NAT is about reaching the internet; the failure is caused by missing NACL outbound permissions within the VPC path for return traffic.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.