An Administrator has an Amazon EC2 instance with an IPv6 address. The Administrator needs to prevent direct access to this instance from the Internet.
The Administrator should place the EC2 instance in a:

A. Private Subnet with an egress-only Internet Gateway attached to the subnet and placed in the subnet Route Table.
B. Public subnet with an egress-only Internet Gateway attached to the VPC and placed in the VPC Route Table.
C. Private subnet with an egress-only Internet Gateway attached to the VPC and placed in the subnet Route Table.
D. Public subnet and a security group that blocks inbound IPv6 traffic attached to the interface.