In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subnet.
What should you do?

A. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with no tag. B. Create a more specific route than the system-generated subnet route, pointing the next hop to instance-B with a tag applied to instance-A. C. Delete the system-generated subnet route and create a specific route to instance-B with a tag applied to instance-A. D. Move instance-B to another VPC and, using multi-NIC, connect instance-B's interface to instance-A's network. Configure the appropriate routes to force traffic through to instance-A.