Add a network ACL Deny for the port and source IP to block the suspicious traffic

NACLs support explicit Deny and are evaluated before security groups, so a Deny for the port+source IP stops the suspicious traffic while the instance stays available to legitimate users. Removing the port from the SG inbound rules (B) would also block legitimate users; security groups cannot Deny (C is invalid); a new NACL denying all egress from the instance (D) would break the app's own outbound traffic. A is correct.

A single EC2 instance is getting suspicious traffic on an open TCP port from an external source, and the app must stay available to others. Security groups are stateful and can only allow (no explicit deny), so the precise block is a network ACL Deny rule for that port and source IP on the instance's subnet—stateless and immediate, and scoped to one instance so other users are unaffected.

Editing the security group to remove the port (B)—that blocks all inbound on that port, including legitimate users, violating 'app must remain available.' Trying to add a Deny in a security group (C)—security groups are allow-only, they have no deny entries. Creating a new NACL that denies all egress (D) breaks the instance's outbound traffic. A is the targeted control.