A company runs servers on Amazon EC2 instances in a VPC. External vendors access these servers over the internet. The company deployed a new application on EC2 instances in a new CIDR range. Security groups and network ACLs allow the required inbound ports, but vendors still cannot connect. Which change will provide vendor access to the application?

The correct answer is to modify the network ACL to allow outbound traffic to ephemeral ports. Network ACLs are stateless, meaning they don't automatically allow return traffic for established connections. When a client (vendor) initiates a connection to a server, the server's response traffic uses ephemeral ports (typically 1024-65535) as the source port. If the network ACL on the EC2 instance's subnet doesn't explicitly allow outbound traffic on these ephemeral ports, the response will be blocked, preventing the connection from completing. Incorrect options: Security groups are stateful; they automatically allow return traffic for allowed inbound connections, so mirroring outbound rules isn't necessary for this issue. Internet gateways do not have configurable inbound rules for specific ports; their function is to provide internet connectivity. Mirroring outbound rules to inbound rules on a network ACL is incorrect because inbound rules govern traffic entering the subnet, not return traffic from established outbound connections.