A SysOps admin launches a public-facing website on an EC2 instance placed in an existing public subnet and associates an Elastic IP. The admin then attached a security group allowing inbound HTTP (port 80) from 0.0.0.0/0. A new network ACL was created and applied to the subnet permitting inbound HTTP from 0.0.0.0/0. Despite these changes, the site is still unreachable from the internet. What is the most likely reason?

Network ACLs are stateless, meaning they don't automatically allow return traffic. For a web server to respond to an incoming HTTP request (port 80), the NACL must have an outbound rule allowing traffic on ephemeral ports (typically 1024-65535) back to the client. Without this outbound rule, the server receives the request but cannot send the response, making the site unreachable. The security group is stateful, so an explicit outbound rule for HTTP is not needed. Elastic IPs, once associated, remain with the instance unless manually reallocated. While another NACL could block traffic, the problem states a new NACL was created and applied, implying it's the primary one in effect for the subnet.