A bank's mobile stack runs in a VPC that uses only IPv4. The bank must integrate a third-party API that requires IPv6. The servers are in private subnets, must initiate all IPv6 connections, and must not accept IPv6 traffic from the public internet. IPv6 has been enabled for the VPC and private subnets. What configuration will provide the required IPv6 egress-only behavior?

The correct option is to create an egress-only internet gateway (EIGW) and configure route tables to direct IPv6 traffic to it. An EIGW is specifically designed for IPv6 traffic, allowing instances in private subnets to initiate outbound IPv6 connections to the internet while preventing inbound connections from the internet. This fulfills the requirement for egress-only behavior. Incorrect options: Creating an internet gateway and a NAT gateway (or NAT instance) is for IPv4 traffic. NAT gateways/instances do not handle IPv6 traffic. Attaching a security group to an EIGW is unnecessary and incorrect. Security groups are associated with network interfaces (like EC2 instances), not gateways themselves. The EIGW inherently provides the desired egress-only functionality without additional security group rules on the gateway.