A network engineer adds IPv6-only subnets and launches an IPv6-addressed EC2 instance in a test VPC. The instance cannot reach an IPv4-only internet service. The engineer needs to enable the IPv6 instance to communicate with the IPv4-only service. Which solution meets the need?

To allow an IPv6-only instance to reach an IPv4-only service, you need a mechanism to translate between the two protocols. AWS provides DNS64 and NAT64 for this purpose. Enabling DNS64 for the IPv6-only subnets ensures that DNS queries for IPv4 services return AAAA records with IPv6 addresses that map to the IPv4 service. The NAT gateway then performs the NAT64 translation, converting the IPv6 traffic from the instance to IPv4 traffic for the internet service. The updated route tables direct the IPv6 traffic destined for these translated addresses to the NAT gateway. "Enable NAT64 for the testing VPC and reconfigure the existing NAT gateway to support IPv6" is incorrect because NAT gateways inherently support NAT64 when paired with DNS64; you don't "reconfigure" them for it. "Enable DNS64 for the new EC2 instance and create a new egress-only internet gateway that supports IPv6" is incorrect because DNS64 is configured at the subnet level, not per instance, and an egress-only internet gateway is for IPv6 outbound traffic only, not for IPv6-to-IPv4 translation. "Enable NAT64 for each route table and create a new NAT gateway that supports both IPv4 and IPv6" is incorrect because NAT64 is a function of the NAT gateway itself, not enabled per route table, and existing NAT gateways already handle the translation when DNS64 is in place.