A user cannot RDP from a home PC over the internet to a bastion host running Windows on EC2. Which of the following are plausible reasons for the connection problem? (Choose two.)

A network ACL acts as a stateless firewall for a subnet. If it's blocking the traffic, the RDP connection will fail. A route table without a route to an Internet Gateway means the bastion host cannot communicate with the internet, preventing RDP from a home PC. The instance lacking a private IP address is incorrect because private IPs are for internal communication, not internet access. A missing inbound rule for port 22 is incorrect because RDP uses port 3389, not 22 (which is for SSH). A missing outbound rule for port 3389 is incorrect because outbound rules typically allow all traffic by default, and RDP is an inbound connection.