SOA-C02 Practice Question: NACL ephemeral port rules required for response…
A security team applied Network ACL rules to a subnet to allow inbound TCP traffic on port 443 (HTTPS). Users connecting from the internet can initiate connections, but they never receive responses. The NACL is applied to the subnet containing the web servers. What is missing?
⚠ Common exam trap
Many exam-takers confuse stateless NACLs with stateful security groups, assuming that allowing inbound traffic automatically permits outbound responses, when in fact NACLs require explicit outbound rules for return traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an outbound NACL rule allowing TCP on destination ports 1024–65535 to permit response traffic to clients' ephemeral ports
Network ACLs are stateless, meaning they evaluate each packet independently without tracking connection state. While the inbound rule allows HTTPS traffic (TCP 443) to reach the web servers, the outbound response traffic from the servers to the clients' ephemeral ports (typically 1024–65535) is blocked by the default deny-all outbound rule. Adding an outbound NACL rule allowing TCP traffic on destination ports 1024–65535 permits the response traffic to flow back to the clients, resolving the issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add an outbound NACL rule allowing TCP on destination ports 1024–65535 to permit response traffic to clients' ephemeral ports
Why this is correct
Ephemeral ports are the temporary high-numbered ports clients open for receiving responses. Because NACLs are stateless, return traffic must be explicitly allowed by an outbound rule. The rule 'Allow TCP outbound to 0.0.0.0/0 on ports 1024–65535' covers all client ephemeral port ranges and allows the web server's responses to flow back to the client.
- ✗
Enable stateful packet inspection on the NACL by toggling the 'track connections' setting in the VPC console
Why it's wrong here
NACLs are always stateless and there is no setting to enable stateful inspection. Stateful packet filtering is a feature of security groups, not NACLs. The NACL always requires explicit inbound and outbound rules for both request and response traffic.
- ✗
Add a security group outbound rule allowing all traffic because NACL rules only apply to inbound traffic
Why it's wrong here
NACLs apply to both inbound and outbound traffic on the subnet. Security group outbound rules are separate from NACL outbound rules. The security group may already allow outbound traffic, but the NACL is a separate layer that also must permit the outbound response packets.
- ✗
Change port 443 to allow both TCP and UDP protocols in the inbound NACL rule
Why it's wrong here
HTTPS uses TCP only. Changing to UDP would not match HTTPS connections. The problem is not the protocol on the inbound rule — it is the missing outbound rule for ephemeral ports on the response side.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.