A company has set up some EC2 Instances in a VPC with the default Security group and NACL settings. They want to ensure that the IT admin staff can connect to the EC2 Instance via SSH. As an architect, what would you ask the IT admin team to do to ensure that they can connect to the EC2 Instance from the Internet? Choose 2 answers from the options below.

Answer options:

A.Ensure that the Instance has a Public or Elastic IP.
B.Ensure that the Instance has a Private IP.
C.Ensure to modify the Security groups.
D.Ensure to modify the NACL rules.

Answer - A and C
The AWS Documentation mentions the following.
To enable access to or from the internet for instances in a VPC subnet, you must do the following.
Attach an Internet gateway to your VPC.Ensure that your subnet`s route table points to the internet gateway.
Ensure that instances in your subnet have a globally unique IP address (public IPv4 address, Elastic IP address, or IPv6 address).
Ensure to add an inbound rule to allow traffic from SSH with source 0.0.0.0/0. By default, all outbound traffic is allowed.
Option B is incorrect since the Private IP will always be created and would not connect from the internet.
If you use the private IP to communicate, traffic will stay within the VPC. It will not be routed out. The routing table will route it internally.
If you use the public IP to communicate, traffic will go out to the internet (through the internet gateway) and return to your VPC.Instances receive a Public IP address so that it is reachable from outside the VPC. This IP address might change if the instance stops and starts. Alternatively, you can use an Elastic IP Address that remains static.
Option D is incorrect since the default NACL rules will allow all traffic.
For more information on exposing VPC resources to the Internet, please refer to the below link-
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Internet_Gateway.html