Amazon Virtual Private Cloud

1A company runs a web application on multiple Amazon EC2 instances in a VPC. The application needs to write sensitive data to an Amazon S3 bucket. The data cannot be sent over the public internet. Which solution will meet these requirements?

1. ACreate a gateway VPC endpoint for Amazon S3. Create a route in the VPC route table to the endpoint.
2. BCreate an internal Network Load Balancer that has the S3 bucket as the target.
3. CDeploy the S3 bucket inside the VPC. Create a route in the VPC route table to the bucket.
4. DCreate an AWS Direct Connect connection between the VPC and an S3 regional endpoint.

2You need to set up security for your VPC and you know that Amazon VPC provides two features that you can use to increase security for your VPC: Security groups and network access control lists (ACLs). You start to look into security groups first. Which statement below is incorrect in relation to security groups?

1. AAre stateful: Return traffic is automatically allowed, regardless of any rules.
2. BEvaluate all rules before deciding whether to allow traffic.
3. CSupport allow rules and deny rules.
4. DOperate at the instance level (first layer of defense).