A county wants to stop EC2 fleets from resolving and connecting to known-malicious domains on egress without rewriting every application. Which network-layer improvement fits?
Select an answer to reveal the explanation.
Short Explanation
Hosts files and hope do not scale when malware domains change daily. DNS Firewall and Network Firewall sit on the road out of town and slam the gate on known-bad names. Central egress controls beat editing every server by hand.
Full Explanation
Improving network-layer security on existing solutions can use AWS Network Firewall for traffic inspection/filtering and Route 53 DNS Firewall for domain-based blocking on egress. Removing all internet paths breaks operations; wide-open egress with host AV alone and per-host hosts files are weak or unscalable. Continuous improvement places managed network controls where municipal fleets share egress.