An application cannot connect from an EC2 network interface to another supported resource inside the VPC. Operations wants configuration-based analysis of route tables, security groups, and network ACLs to identify a blocking component without sending live test packets. Which tool is the most direct fit?

1. Inspect only the destination security group and assume every upstream route and network ACL is valid.
2. Use only VPC Flow Logs and expect a configuration path analysis without generating or observing any traffic.
3. VPC Reachability Analyzer for the supported source, destination, protocol, and port.
4. Run ping from the source instance and use its success as proof that the required TCP port is permitted.