A company will run a compute-heavy data processing application on AWS. The VPC must have no direct internet access and strict network controls. Data scientists transfer data from an on-premises data center over a Site-to-Site VPN. The on-premises network uses 172.31.0.0/20 and the application VPC uses 172.31.16.0/20. Data scientists can launch instances but cannot transfer data from on premises. VPC flow logs of a ping show denied or missing traffic entries. What change will allow the data scientists to transfer data from the on-premises network?

The correct answer is to modify the network ACLs for the VPC subnet by adding an outbound rule. Network ACLs are stateless, meaning both inbound and outbound rules must be explicitly defined for traffic to flow in both directions. Since data scientists can launch instances but not transfer data, and flow logs show denied/missing traffic, it indicates a blockage at the network ACL level. An outbound rule is needed to allow the return traffic from the application instances back to the on-premises network. Modifying the security group (inbound or outbound) is incorrect because security groups are stateful and automatically allow return traffic once an initial connection is established. Modifying the network ACLs with an inbound rule is also incorrect as the problem describes data transfer from on-premises, implying the initial connection is inbound, but the issue is with the return path.