A company runs an Amazon SageMaker AI domain in a public subnet of a newly created VPC. The network is configured and engineers can access the domain. The company discovered suspicious traffic originating from a specific IP address and needs to block that IP. Which network configuration change will accomplish this?

The correct answer is to create a network ACL inbound rule that denies traffic from the specific IP address. Network ACLs operate at the subnet level and provide stateless packet filtering, meaning they evaluate rules for both inbound and outbound traffic independently. By adding a deny rule for the suspicious IP to the network ACL associated with the subnet, all traffic from that IP will be blocked before it reaches any instances within the subnet, including the SageMaker domain. Security groups are stateful and operate at the instance level. While they can deny traffic, attaching a new security group to an existing SageMaker domain might not be straightforward or could disrupt existing access. Also, security groups are typically used to allow specific traffic, not explicitly deny individual IPs at the subnet level. Shadow variants and SageMaker Inference Recommender are for A/B testing or performance optimization of models, not network security. VPC route tables determine where network traffic is directed, not whether it is allowed or denied based on source IP.