AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

Network ACLs are stateless, so return traffic must be explicitly permitted. When an instance initiates an HTTPS session, the reply from the remote host arrives from source port 443 and is addressed to an ephemeral port (1024-65535) on the instance. Because the inbound rule set does not currently allow that destination port range, the response is dropped, breaking the connection. Adding an inbound rule that allows TCP 1024-65535 from any source permits only the necessary return traffic while leaving other traffic blocked, satisfying the principle of least privilege. Allowing the same range on the outbound side does nothing for inbound return packets, and opening all ports or all protocols is less restrictive than required.