You have a bastion host EC2 instance on AWS VPC public subnet. You would want to SSH to Bastion host EC2 instance. What would be the secure and minimal configuration you need for SSH requests to work? Assume route table is already set up with Internet Gateway.

Answer options:

A.Allow SSH protocol(port 22) on Security Group Inbound and Security Group Outbound.
Allow Network ACL inbound and Network ACL outbound for IP range 0.0.0.0/0
B.Allow SSH protocol(port 22) on Security Group Inbound and Security Group Outbound.
Allow Network ACL inbound for your IP address.
C.Allow SSH protocol(port 22) on Security Group Inbound and Network.
ACL inbound for your IP address
D.Allow SSH protocol(port 22) on Security Group Inbound.
Allow Network ACL inbound and Network ACL outbound for your IP address.

Answer D
Security groups are stateful — if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules.
Responses to allowed inbound traffic are allowed to flow out, regardless of outbound rules.
Network ACLs are stateless; responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa). 
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Security.html#VPC_S ecurity_Comparison
In option A, Security Group outbound is not necessary for SSH connection to work. Also, opening to 0.0.0.0/0 is insecure as it allows ALL on SSH. Although this option works, this is not secure and not a minimal configuration.
In options B and C, Network ACL outbound is not open. According to Network ACL stateless definition, this option would fail.
In option D, this is a minimal and secure configuration to open only to your IP address. This is the correct answer.