A county wants to stop EC2 fleets from resolving and connecting to known-malicious domains on egress without rewriting every application. Which network-layer improvement fits?
Select an answer to reveal the explanation.
Short Explanation
Hosts files and hope do not scale when malware domains change daily. DNS Firewall and Network Firewall sit on the road out of town and slam the gate on known-bad names. Central egress controls beat editing every server by hand.
Full Explanation
A county that wants EC2 fleets to stop resolving and connecting to known-malicious domains on egress without rewriting every application needs network-layer controls. Introducing AWS Network Firewall and/or DNS Firewall on egress paths blocks known-bad domains and inspects outbound traffic centrally for the fleet. That improvement fits because application-agnostic DNS and network filtering scales across municipal workloads without per-app code changes. Removing all NAT Gateways so instances cannot reach the internet fails by breaking patching and updates rather than surgically blocking malice. Opening all outbound security group rules to 0.0.0.0/0 and relying solely on host antivirus fails conceptually as unbounded egress with only endpoint hope. Publishing a static hosts file manually on each instance listing every blocked domain fails operationally—threat intel changes faster than hand-edited hosts files. Exam caveat: DNS Firewall and Network Firewall need rule-group ownership, logging, and exception processes for legitimate domains that might collide with block lists. Operational check: enable DNS Firewall domain lists on the VPC resolver path, log blocked queries, pilot Network Firewall on a noncritical subnet, measure false positives for one week, then expand coverage.