An Amazon EC2 instance in a VPC is receiving a high volume of suspicious traffic on an open TCP port from a specific external source. The port must be blocked for that source without affecting other users. What should the security team do?

Updating the network ACL (NACL) associated with the instance's subnet to add a deny rule for the specific port and offending source IP addresses is the most effective solution. NACLs are stateless, meaning they evaluate every rule for every packet, and they process rules in order from lowest to highest. A deny rule placed before any allow rules for that port will block the malicious traffic without affecting other legitimate users accessing different ports or the same port from other sources. Modifying the instance's security group to remove the port would block all traffic to that port, impacting legitimate users. Security groups are stateful and only support allow rules; they do not have explicit deny rules. Adding a "deny rule" to a security group is not possible. Creating a new NACL to deny all traffic from the EC2 instance would prevent all outbound communication, causing a denial of service for the instance.