Why can a security group allow outbound HTTPS to the internet without an explicit inbound rule for the response traffic?
A.Security groups are stateful — return traffic for an allowed connection is automatically permitted
Correct. Connection tracking means responses to initiated connections return freely.
B.HTTPS responses arrive on port 443 which is open by default
Inbound 443 isn't default-open — the response uses a high ephemeral port anyway.
C.The internet gateway tracks sessions and bypasses security groups
The IGW routes traffic; it doesn't override security group evaluation.
D.Ephemeral ports are always allowed in security groups
Nothing is 'always allowed' — statefulness is the mechanism, not open ephemeral ranges.
Why this answer
Security groups are stateful: if you send a request out, the response is allowed back regardless of inbound rules. NACLs are stateless — return traffic needs an explicit inbound rule on ephemeral ports.
Correct answer: A · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Infrastructure Security practice session.
Practice Infrastructure Security