The correct answer is D, Network Access Control List (ACL). A Network ACL operates at the subnet level and provides an additional layer of security by allowing or denying specific inbound or outbound traffic. Unlike Security Groups, which are stateful and operate at the instance level, Network ACLs are stateless and operate at the subnet level. Route tables (B) are used for routing traffic within a VPC, while VPC endpoints (C) enable private connections between VPCs and AWS services. Security groups (A), although they act as a virtual firewall, control traffic at the instance level, not the subnet level.