How should security groups be configured in this situation?

A solutions architect is designing a two-tier web application. The application consists of a public-facing web tier hosted on Amazon EC2 in public subnets. The database tier consists of Microsoft SQL Server running on Amazon EC2 in a private subnet Security is a high priority for the company

How should security groups be configured in this situation? (Select TWO)
A . Configure the security group for the web tier to allow inbound traffic on port 443 from 0.0.0.0/0.
B . Configure the security group for the web tier to allow outbound traffic on port 443 from 0.0.0.0/0.
C . Configure the security group for the database tier to allow inbound traffic on port 1433 from the security group for the web tier.
D . Configure the security group for the database tier to allow outbound traffic on ports 443 and 1433 to the security group for the web tier.
E . Configure the security group for the database tier to allow inbound traffic on ports 443 and 1433 from the security group for the web tier.

View Answer

Answer: A, C

Explanation:

"Security groups create an outbound rule for every inbound rule." Not completely right. Statefull does NOT mean that if you create an inbound (or outbound) rule, it will create an outbound (or inbound) rule.

What it does mean is: suppose you create an inbound rule on port 443 for the X ip. When a request enters on port 443 from X ip, it will allow traffic out for that request in the port 443. However, if you look at the outbound rules, there will not be any outbound rule on port 443 unless explicitly create it. In ACLs, which are stateless, you would have to create an inbound rule to allow incoming requests and an outbound rule to allow your application responds to those incoming requests.

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#SecurityGroupRules