Which of the following would be used to explicitly deny the traffic from a foreign IP address scanning the EC2 Instances in a VPC?

Security Groups are associated directly with EC2 instances and evaluate all inbound traffic against their configured allow rules. By specifying only trusted source IP ranges in the inbound rules, all traffic from foreign or unlisted IP addresses - including port scanning attempts - is implicitly denied at the instance level before it can reach the EC2 instance.

A VPC Endpoint enables private connectivity between a VPC and supported AWS services without traversing the public internet; it does not filter or block traffic from external IP addresses.

A Network ACL operates at the subnet level and applies stateless rules to all instances in a subnet rather than targeting specific EC2 instances, making Security Groups the more direct and granular control mechanism for individual instances.

An Internet Gateway enables routing between a VPC and the internet but does not inspect, filter, or deny traffic based on source IP address.