GuardDuty reports suspicious outbound network traffic from an EC2 instance and identifies an unfamiliar external IP address as the destination. The administrator needs to prevent traffic to that external IP immediately. Which action will accomplish this?

The correct action is to create or update a network ACL (NACL) on the subnet to add an outbound deny rule for the external IP address. NACLs operate at the subnet level and are stateless, meaning they evaluate every rule for every packet. An explicit deny rule for the suspicious IP will immediately block all traffic to that destination from any instance within that subnet, providing an effective and swift remediation. Creating a new security group and attaching it to the EC2 instance is incorrect because security groups are stateful and primarily control inbound and outbound traffic to the instance. While you could create an outbound deny rule, NACLs are more effective for immediate, broad subnet-level blocking. Analyzing VPC flow logs with Amazon Athena is a reactive analysis step, not an immediate blocking action. Creating a security group and applying it at the VPC level is incorrect because security groups are applied to instances, not directly to the VPC.