Quick Answer

The answer is to apply the inbound ACL to the same interface, but only after evaluating outbound traffic and creating the reflexive entry. This order is correct because a reflexive ACL, also known as dynamic inspection, works by first inspecting outbound packets to dynamically generate a temporary permit entry for the return traffic; that entry is then inserted into the inbound ACL on the same interface, allowing only the corresponding reply packets back in. On the ENCOR 350-401 exam, this concept often appears as a drag-and-drop sequence testing your understanding of stateful filtering logic, with a common trap being the mistaken belief that the inbound ACL is applied first. To avoid this, remember the key principle: outbound traffic must be seen before the inbound rule can be created. A simple memory tip is "Out first, then in" — think of it as the router needing to see the conversation start before it can let the reply through.