Two application subnets inside one AWS VPC must stop communicating with each other. The site-to-site VPN from the campus must stay up, and inbound internet publishing is unchanged. Which policy belongs on this change?
Select an answer to reveal the explanation.
Short Explanation
The two rooms are inside the same building, and you need to lock the door between them. That is an east-west rule on a security group or network ACL. You do not tear down the campus VPN, and you do not rewrite the inbound internet policy.
Full Explanation
East-west traffic here is packet flow between two subnets in the same VPC. Security groups and network ACLs are the cloud controls that permit or deny that flow without touching the site-to-site VPN or the way the VPC is published to the internet. A backhaul rule that sends the VPC's internet egress through the campus is a different policy goal: inspection of north-south internet traffic. It does not stop the two subnets from talking inside AWS. An inbound rule on the internet gateway, or on the resources behind it, filters sessions that start on the public internet. The requirement says that publishing stays as it is, and those sessions are not the subnet-to-subnet flow. Replacing the virtual private gateway with a Direct Connect public virtual interface changes the campus connectivity model and still does not segment the two subnets. A public virtual interface is also the wrong virtual-interface type for private VPC prefixes. Exam caveat: network ACLs are stateless and security groups are stateful. Either can implement the split, but the rule direction has to match the tool you pick. Operational check: from an instance in the first subnet, confirm the second subnet's port now fails while the campus VPN tunnel status stays up.