A user connected to an EC2 host in a private subnet cannot retrieve http://www.example.com using curl. The VPC configuration shows: the private subnet routes 0.0.0.0/0 to a NAT Gateway; the instance's outbound security group rule allows only port 443 to 0.0.0.0/0; the instance's inbound security group permits ports 22 and 443 from the user's IP; the subnet's inbound NACL permits port 22 and ephemeral ports (1024–65535) from anywhere. What change will enable the curl http request to succeed?

The curl http://www.example.com command uses HTTP, which typically operates on port 80. The current outbound security group rule only allows port 443 (HTTPS). To allow the HTTP request to succeed, an outbound security group rule must be added to permit traffic on port 80. Security groups are stateful, so an outbound rule for port 80 will automatically allow the return traffic. Incorrect options: Adding inbound NACL or security group rules for port 80 is unnecessary because the request originates from the instance (outbound) and the response will be allowed by the stateful security group. Adding an outbound rule to the user's IP is too restrictive; the request is going to www.example.com, not the user's IP.