Stateless behavior of NACLs in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does it mean that a Network ACL (NACL) is stateless?

A stateless NACL means it does not remember previous traffic. Each request and response is checked separately against the rules.

beginner

How does stateless behavior affect return traffic in NACLs?

Return traffic must have explicit rules allowing it because NACLs do not automatically allow responses to allowed requests.

intermediate

Why might you need to add both inbound and outbound rules in a NACL?

Because NACLs are stateless, you must allow traffic in both directions explicitly for communication to work.

intermediate

Compare stateful and stateless firewalls in simple terms.

Stateful firewalls remember traffic and automatically allow return traffic. Stateless firewalls like NACLs check each packet alone without memory.

beginner

What happens if you allow inbound traffic but forget to allow outbound traffic in a NACL?

The inbound traffic might reach the resource, but the response will be blocked because outbound rules are missing.

What is a key characteristic of a stateless NACL?

A It checks each packet independently without remembering past packets

B It automatically allows return traffic

C It stores session information for traffic

D It only filters outbound traffic

Stateless NACLs do not keep track of traffic sessions and evaluate each packet on its own.

If you allow inbound HTTP traffic on a NACL, what else must you do for the connection to work?

A Allow outbound HTTP response traffic explicitly

B No additional rules are needed

C Allow inbound SSH traffic

D Disable the NACL

Because NACLs are stateless, outbound response traffic must be allowed explicitly.

Which AWS component is stateless by design?

A IAM Role

B Security Group

C Elastic Load Balancer

D Network ACL (NACL)

NACLs are stateless, while Security Groups are stateful.

What happens if outbound rules are missing in a stateless NACL?

A Traffic flows normally

B Inbound traffic is blocked

C Return traffic is blocked

D NACL automatically adds outbound rules

Without outbound rules, return traffic cannot pass through a stateless NACL.

Why might stateless NACLs require more rules than stateful firewalls?

A Because they remember all traffic

B Because they need explicit rules for both inbound and outbound traffic

C Because they only filter inbound traffic

D Because they automatically allow all traffic

Stateless NACLs require explicit rules for both directions since they don't track sessions.

Explain in your own words what stateless behavior means for Network ACLs and how it affects traffic flow.

Think about how each packet is treated independently.

Describe a scenario where forgetting to add outbound rules in a NACL causes a problem.

Imagine a web server receiving requests but not sending responses.