A customer has an instance hosted in the public subnet of the default VPC. The subnet has the default settings for the Network Access Control List. An IT Administrator needs to be provided SSH access to the underlying instance. How could this be accomplished?

Answer options:

A.Ensure the Network Access Control Lists allow Inbound SSH traffic from the IT Administrator’s Workstation.
B.Ensure the Network Access Control Lists allow Outbound SSH traffic from the IT Administrator’s Workstation.
C.Ensure that the Security group allows Inbound SSH traffic from the IT Administrator’s Workstation.
D.Ensure that the Security group allows Outbound SSH traffic from the IT Administrator’s Workstation.

Correct Answer - C
Ensure that the security group allows Inbound SSH traffic from the IT Administrator’s Workstation. Since Security groups are stateful, we do not have to configure outbound traffic. What enters the inbound traffic is allowed in the outbound traffic too.
Note: The default network ACL is configured to allow all traffic to flow in and out of the subnets to which it is associated.
Based on this, Option C is the correct answer.
Since the IT administrator needs to be provided SSH access to the instance, the traffic would be inbound to the instance. Security group being stateful means that return response to the allowed inbound request will be allowed and vice-versa.
Reference:
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#DefaultSecurityGroup