A TCP client can initiate connections after a network ACL update, but replies are dropped. Security groups allow the session. What is the most likely ACL issue?

1. Network ACLs automatically permit every established return packet.
2. The stateless ACL lacks the required return-direction ephemeral-port allowance.
3. The ACL needs an IAM role to remember the TCP connection.
4. A DNS CNAME is required for the ACL to allow TCP replies.