A website runs a web tier (EC2 Auto Scaling group across two AZs) and a DB tier (RDS for MySQL Multi-AZ). Database subnet network ACLs are restricted to only the web subnets that need DB access; the web subnets use default NACL rules. A third subnet was recently added to the Auto Scaling group. After scaling, some users intermittently see errors that the web server cannot connect to the database. Route tables and security groups have been verified. What changes should a SysOps admin make so web servers in the new subnet can reach the DB instance? (Choose two.)

Network ACLs are stateless, meaning they evaluate both inbound and outbound traffic independently. For the new web subnet to connect to the database, two rules are necessary on the database subnet's NACL. First, an inbound Allow rule for port 3306 (MySQL) from the new web subnet's CIDR is needed to permit the initial connection request. Second, an outbound Allow rule for the ephemeral TCP port range (typically 1024-65535) with the destination set to the new web subnet's CIDR is required to allow the database to send response traffic back to the web servers. Without both rules, the connection will fail. The default NACL on the web subnets does not need modification as it already allows all traffic.