A company is testing incident response procedures for destination containment. The company must isolate a critical Amazon EC2 instance immediately while keeping it running. The instance is the only resource in its public subnet and has active connections to other resources. Which solution will contain the instance immediately?

The correct solution is to create a new network ACL (NACL) with deny rules for all inbound and outbound traffic and associate it with the subnet. NACLs operate at the subnet level, providing an immediate and comprehensive way to block all traffic to and from the EC2 instance within that subnet without stopping the instance. This fulfills the requirement to isolate the instance while keeping it running. Modifying the instance's security group or attaching a new one would only affect traffic at the instance level and might not immediately sever all existing connections or prevent new ones if other security groups are also attached or if the existing rules are complex. Creating a new VPC and migrating the instance would involve stopping the instance, which violates the requirement to keep it running.