A SysOps administrator starts a Linux EC2 instance in a public subnet and obtains its public IP address. Each attempt to SSH into the instance times out. What change will permit the administrator to remotely connect to the instance?

The correct answer is to modify the instance’s security group to allow inbound SSH (TCP 22) from the administrator’s IP address. Security groups act as virtual firewalls at the instance level, controlling both inbound and outbound traffic. For SSH to work, the security group must explicitly permit inbound connections on TCP port 22 from the source IP address (the administrator's machine). A timeout indicates that the connection is being blocked, most commonly by a security group. Adding a route table entry is incorrect because routing tables direct traffic between subnets and to the internet, but they don't filter traffic at the instance level. Adding an outbound network ACL rule is incorrect because network ACLs are stateless and operate at the subnet level; while they can block traffic, the primary issue for inbound connection timeouts is typically the security group. Modifying the security group for outbound SSH is incorrect because the problem is establishing an inbound connection to the instance, not an outbound connection from it.