Which of the following services can be used to block network traffic to an instance?

Explanations:

Security groups act as a virtual firewall to control inbound and outbound traffic for instances. They allow or deny traffic based on defined rules.

Amazon VPC flow logs are used for monitoring and capturing information about the IP traffic going to and from network interfaces but do not block traffic.

Network ACLs (Access Control Lists) are stateless firewalls that can allow or deny traffic to and from subnets in a VPC. They can effectively block traffic.

Amazon CloudWatch is primarily used for monitoring and logging metrics and events but does not have functionality to block network traffic.

AWS CloudTrail is used for governance, compliance, and auditing but does not control or block network traffic.