A public subnet hosts two Amazon EC2 instances and uses a custom network ACL. The design must: (1) allow outbound access to an internet service over TLS (TCP 443) and (2) deny inbound traffic to MySQL (TCP 3306). Which network ACL rules satisfy these requirements?

The correct option satisfies both requirements. Requirement (1) needs outbound access to an internet service over TLS (TCP 443). This is handled by "Outbound rule 100: Allow TCP 443". For stateful responses to this outbound connection, the "Inbound rule 200: Allow TCP 443" is also necessary, as network ACLs are stateless. Requirement (2) needs to deny inbound traffic to MySQL (TCP 3306). This is handled by "Inbound rule 100: Deny TCP 3306". Network ACLs process rules in order, so the deny rule for 3306 must come before any allow-all or allow-ephemeral-ports rule. The first incorrect option is missing an inbound rule for ephemeral ports, which are needed for the return traffic of the outbound TCP 443 connection. The second incorrect option has an inbound rule allowing TCP 1024-65535, which would inadvertently allow TCP 3306 if it came after the deny rule. The third incorrect option also has an inbound rule allowing TCP 1024-65535, which would allow TCP 3306 if it came after the deny rule.