Reference Material:

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#nacl-basics
"NACLs are stateless, which means that information about previously sent or received traffic is not saved. If, for example, you create a NACL rule to allow specific inbound traffic to a subnet, responses to that traffic are not automatically allowed. This is in contrast to how security groups work. Security groups are stateful, which means that information about previously sent or received traffic is saved. If, for example, a security group allows inbound traffic to an EC2 instance, responses are automatically allowed regardless of outbound security group rules."
A fulfils the security group requirement
E is the only option that explicitly covers outbound traffic and ports.
D covers outbound destination but given that all traffic is blocked (as per the question) this won't work