A transit gateway sends flow logs to a CloudWatch Logs group. A Lambda analyzes the logs and publishes SNS notifications when a VPC generates traffic the transit gateway drops. Each notification includes account ID, VPC ID, and dropped packet totals. A new Lambda subscribed to the SNS topic must automatically stop the identified traffic from leaving the originating VPC by applying a network ACL to the transit gateway attachment subnets in that VPC. Which approach satisfies this requirement?

The correct approach is to modify the existing Lambda to include the destination IP addresses of the dropped traffic in each SNS notification and have the new Lambda create an outbound network ACL rule using those destination IP addresses. Network ACLs are stateless, meaning both inbound and outbound rules must be explicitly defined. To stop traffic from leaving the originating VPC, an outbound rule is needed. This rule should block traffic destined for the problematic IP addresses identified in the dropped flow logs. Incorrect options: Including source IP addresses and creating an inbound rule would block traffic entering the VPC from those sources, not traffic leaving it. Including source IP addresses and creating an outbound rule would block traffic from the VPC to those source IP addresses, which is not the goal. The goal is to block traffic from the VPC to the destination IP addresses that caused the drop. Including destination IP addresses and creating an inbound rule would block traffic entering the VPC from those destinations, which is not relevant to stopping traffic from leaving.