Exercise 2: Why Stateful Security Groups Need No Separate Outbound Rule — Possible Solution
====================================================================

A stateful firewall tracks the real, individual CONNECTION a piece of
traffic belongs to, not just each packet in isolation. When an
inbound rule allows a connection in -- for example, an inbound rule
permitting HTTPS traffic on port 443 -- the security group remembers
that a specific connection was allowed, and automatically permits the
matching reply traffic back out as part of that same tracked
connection, regardless of what the security group's own outbound
rules say.

A stateless system, by contrast, would evaluate every single packet
independently in both directions, with no memory of what was already
allowed in -- which is exactly why Network ACLs (covered in Chapter
5), the stateless alternative, require separate, explicit rules for
both inbound and outbound traffic to achieve the same real result.

ANSWER: Because a security group tracks the connection itself, not
just individual packets, allowing traffic in automatically allows its
own reply back out as part of the same real, already-permitted
connection -- no matching outbound rule is needed because the
"outbound" traffic in this case isn't a new, separate flow requiring
its own permission; it's the return half of a connection already
approved.

WHY THIS WORKS AS AN ANSWER
------------------------------
This correctly explains statefulness in terms of connection tracking
rather than just asserting "security groups are stateful" as a fact
to memorize, and sets up the real, direct contrast the chapter itself
promises with Network ACLs in Chapter 5.