What should the SysOps administrator do to meet these requirements with the LEAST operational overhead?

Explanations:

This option allows the EC2 instances to accept traffic only from the NLB’s security group. It simplifies management since the rules automatically adjust if the NLB’s security group changes, providing an efficient way to control access with minimal overhead.

This option suggests allowing traffic from the elastic network interfaces (ENIs) associated with the NLB, which is not a practical approach. ENIs can change, and this method would require constant updates, increasing operational overhead.

While network ACLs can restrict traffic, managing them involves more complexity compared to security groups. Additionally, network ACLs apply to the subnet level rather than specific instances, which might not adequately restrict access only to the NLB.

Implementing a third-party firewall solution introduces unnecessary complexity and operational overhead. This solution requires additional management, maintenance, and potential costs, making it less efficient compared to using security groups.