A bank's VPC has 300 security groups after rapid migration, with auditors flagging overly permissive SSH and database paths that bypass the jump host and Verified Access design. The team needs proof of reachable ports from the internet and unused rules. Which control best identifies unnecessary network access for remediation?

Network Access Analyzer is correct because it analyzes security group, NACL and gateway configuration against internet gateways to prove which SSH and database ports are externally reachable via unintended paths bypassing the jump host and Verified Access design, while Inspector network reachability shows which EC2s are internet-reachable and on which ports to prioritize 300-group cleanup, though neither proves idleness so validate unused rules with flow-log history before deletion. Auditing with VPC Reachability Analyzer and Firewall Manager fails by scope because Reachability Analyzer checks only specified paths on demand and Firewall Manager enforces intended policy, confirming intent rather than enumerating all unintended exposure. Correlating GuardDuty detections with Security Hub insights fails by signal because they surface active malicious behavior and aggregated posture, not configuration reachability or permissive but unexploited rules. Evaluating VPC Flow Logs with CloudTrail histories fails by evidence type because they record historical traffic and API actions, unable to prove reachability if never attempted or prove a rule unused. Exam caveat is to separate possible-path proof from observed traffic or threats, since reachable and unnecessary access favors analyzers over monitoring. Practical check is to scope Network Access Analyzer to internet ingress, export IDs with port ranges, cross-check jump host and Verified Access policy, tighten flagged rules and re-run to confirm zero unintended paths.