A Linux EC2 web server receives HTTPS through a subnet network ACL. Its security group permits the traffic. The ACL allows inbound TCP 443 but blocks outbound ephemeral destination ports. Clients time out during connections. What should operations change?

1. Allow the required outbound return traffic to the clients ephemeral ports in the network ACL.
2. Add a security-group rule allowing outbound TCP 443 and assume it overrides the network ACL deny.
3. Allow outbound destination TCP 443 only, because the server received the request on 443.
4. Increase the Route 53 TTL so clients reuse established TCP connections.