AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

Because network ACLs are stateless, return traffic must be explicitly allowed. The NAT gateway translates the source instance's IP address, but the return traffic from the API (source port 443) must be able to reach the original instance on the ephemeral port it used to initiate the connection (destination ports 1024-65535). If the private subnet's NACL does not allow inbound traffic on this high port range, the connection fails. This rejection is captured by VPC flow logs. Allowing this inbound ephemeral port range on the private subnet's NACL resolves the issue. Attaching an internet gateway would make the instances public, which violates the requirement. Disabling source/destination check is only relevant for NAT instances, not managed NAT gateways. Security groups are stateful, so they automatically allow return traffic for connections initiated by the instance; no inbound rule is needed.