Network Access Control Lists (NACLs)

Correct Answer: Allow TCP protocol with a port range of 443.

To allow HTTPS access to an EC2 instance, the inbound NACL rule should be configured to allow the TCP protocol in the port range of 443. Allowing access to different port ranges or protocols, or denying access to the 443 port range, will not correctly configure HTTPS access.

Correct Answer: Missing inbound and outbound rules for ephemeral ports.

Network ACLs are stateless, so you must explicitly allow both the request and the return traffic. For connections initiated from the internet to your instance (for example, TCP 80/443), the client uses an ephemeral source port (commonly 1024–65535). Your instance’s responses go back to that client’s ephemeral port. If the NACL does not allow the ephemeral port range in the outbound direction, the return traffic is blocked and the connection times out. Similarly, for instance-initiated connections, inbound ephemeral must be allowed for the return path. Therefore, missing inbound and outbound rules for ephemeral ports is a likely cause of the instance being unreachable despite correct routing and security group rules.

Correct Answer: Confirm that the NACL allows traffic from necessary ephemeral ports.

Confirming that the NACL allows traffic from necessary ephemeral ports helps you ensure that the two-way communication is allowed. Missing ephemeral port rules could cause intermittent connectivity issues. Other options mentioned do not address the connectivity problem.