The correct answer is C, Network Access Control List (NACL). NACLs provide stateless network filtering for inbound and outbound traffic at the subnet level within a VPC. Unlike security groups, which are stateful and operate at the instance level, NACLs are stateless and do not track the state of traffic. This means that responses to allowed inbound traffic are subject to the rules for outbound traffic, and vice versa. AWS PrivateLink (A) is used for private connectivity between services, security groups (B) are stateful and provide instance-level security, and AWS WAF (D) is a web application firewall that operates at the application level, not VPC subnet level.