A company has an application VPC and a networking VPC peered together. The networking VPC hosts a Network Load Balancer (NLB). EC2 instances in the application VPC are targets for the NLB. A third VPC is peered to the networking VPC and contains a new version of the application running on EC2 instances in a different Availability Zone. How can the company allow the NLB to reach the new application instances? (Choose three.)

To allow the NLB to reach the new application instances, you must register them as targets. Network Load Balancers support registering targets by IP address, even across VPC peering connections, making "Register the new EC2 instances with the NLB using their IP addresses" correct. Since the new instances are in a different Availability Zone, the NLB must be enabled in that AZ to distribute traffic to them, making "Enable the NLB in the Availability Zone that contains the new EC2 instances" correct. Finally, network ACLs are stateless, so both inbound and outbound rules are required for traffic flow. Therefore, "Update the network ACL for the application subnet in the new VPC to allow both inbound and outbound traffic" is correct. Registering by instance ID is only possible if the instance is in the same VPC as the NLB. Zonal shift is for removing an AZ from service, not for enabling a new one. Updating only outbound NACL rules is insufficient.