A solutions architect is configuring a security group for an Amazon EC2 instance that hosts a simple web server. The architect adds an inbound rule to allow TCP traffic on port from any source (). What outbound rule must the solutions architect add to the security group to allow the HTTP response traffic to reach the clients?
- No outbound rule is required because security groups are stateful, meaning return traffic is automatically allowed.Answer
- BAn outbound rule allowing TCP traffic to destination on ephemeral ports (-) is required.
- CAn outbound rule allowing TCP traffic to destination on port is required.
- DAn outbound rule must be configured in AWS WAF to permit the response traffic, since security groups only inspect incoming packets.
Answer
No outbound rule is required because security groups are stateful, meaning return traffic is automatically allowed.
Security groups in AWS VPCs are stateful. When you create an inbound rule to allow traffic on a specific port (like port ), the security group automatically tracks the connection state and allows the return response traffic to flow outbound to the client. No corresponding outbound rule is required.
Step-by-Step Solution
Key Concept
AWS Security Groups are stateful firewalls that operate at the instance level. They automatically track connection states and allow return traffic without requiring matching outbound rules.