A bank audit found 400 security group rules with 0.0.0.0/0 SSH and unused cross-VPC paths that must be removed without breaking approved Verified Access connections. Which method best identifies unnecessary network access for safe removal?

The correct method succeeds because Network Access Analyzer evaluates intended network scope against actual configuration to surface unintended externally reachable and cross-VPC paths (it finds possible paths, not idle ones, so pair it with flow-log history to confirm non-use), while Inspector reachability findings add workload exposure context, allowing teams to confirm which 0.0.0.0/0 SSH rules are unnecessary and explicitly exclude approved Verified Access connections from removal. The Athena query method over Flow Logs is operationally sound for hygiene but fails for this audit because flow data only proves recent use, not authorized reachability, so a rarely used yet approved Verified Access or failover path can appear idle and be removed incorrectly. The Config auto-remediation method correctly enforces the no-open-SSH guardrail at scale but fails because it remediates compliance without modeling unused cross-VPC connectivity, risking deletion without reachability evidence and with no Verified Access exemption logic. The Security Lake with Detective correlation method is valuable for investigation of active sessions but fails because it prioritizes observed behavior over policy-based accessibility analysis, missing dormant overly permissive paths that have no traffic yet remain exploitable. For the exam, do not equate observed traffic or compliance flags with proof of safe removal when the stem requires preserving an exemption and proving non-use via reachability. In practice, scope the analyzer to audited VPCs, allowlist Verified Access group IDs, and link each deletion to its finding.