An EC2 instance allows by default all inbound and outbound traffic

Explanation

False.  An EC2 instance is created with a default security group.  The default configuration of a security group blocks all inbound traffic and allows all outbound traffic.