An application runs on EC2 instances that all share the same security group. The application must access an Amazon Aurora DB cluster that has its own security group. To provide least-privilege network access between the EC2 instances and the Aurora cluster, which combination of security group rules should be added? (Choose two.)

To establish least-privilege network access, both inbound and outbound rules must be correctly configured. The EC2 instances initiate connections to the Aurora DB cluster. Therefore, an outbound rule is needed on the EC2 instances' security group, allowing traffic to the Aurora security group over the default Aurora port. Concurrently, the Aurora DB cluster must accept these incoming connections. This requires an inbound rule on the DB cluster's security group, permitting traffic from the EC2 instances' security group over the default Aurora port. The incorrect options propose rules that are either in the wrong direction (e.g., inbound to EC2 from DB, or outbound from DB to EC2 for the primary connection) or use incorrect ports (e.g., ephemeral ports for the primary connection).