You have to allow all outbound traffic in a security group in order for your web server to respond to inbound requests

Explanation

False, security groups are stateful. That means that they will remember if a connection is originally initiated by the EC2 instance or from the outside, and temporarily allow traffic to respond without modifying the inbound rules.