I require different levels of access for my application that is installed on an EC2 instance. I have configured an ENI for the same purpose. Which of the following statement is incorrect?

Answer options:

A.I can detach the primary ENI of my EC2 instance and connect it to another instance for moving its Elastic IP
B.I can configure a Security Group for my ENI and restrict traffic to the EC2 instance
C.I can detach a secondary ENI containing a Private IP from one EC2 instance and attach it to another
D.I can attach an Elastic IP to an EC2 instance in another subnet by releasing it from the ENI in the current subnet to which it is currently attached to

Correct Answer: A
Option A is CORRECT. The primary ENI of an instance cannot be detached from the instance. By default, the primary ENI is created with the creation of the EC2 instance & deleted when the instance is terminated
Option B is incorrect since an EC2 instance may require restricted access to certain IP addresses. This can be achieved by creating a new ENI & attaching a Public IP & Security Group restricting permissions.
Option C is incorrect. Secondary ENI’s that are created can be detached from the instance to which it is attached to & attached to another instance within the same subnet. The Private IP then gets allocated to the second instance to which it is attached currently
Option D is incorrect. ENI’s are subnet specific. So for attaching an Elastic IP to an instance in a different subnet, I need to first release it to the pool by dissociating it from an attached instance. This way, I can attach the Elastic IP to an instance in a different subnet.
References:
https://youtu.be/Zg8rMLE88mg
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html