1. You are the Solutions Architect for a medium-sized business that has been gradually shifting its workloads to AWS. The CTO wants to improve the security posture of the company and wants you to implement best practices to secure their workloads. Which of the following should be your primary action? A. Ensure all instances are launched in public subnets to ensure high availability. B. Use a single AWS account for all departments to simplify management and reduce costs. C. Hard code AWS access keys and secret access keys into the application for persistent AWS connectivity. D. Apply the principle of least privilege to IAM roles and enforce MFA (multi-factor authentication). 2. Your company has an e-commerce website hosted on AWS. On certain occasions like Black Friday, you expect a dramatic increase in web traffic. The CTO wants to ensure that the architecture is resilient enough to handle this surge without any downtime or performance degradation. Which of the following approaches would be the most suitable? A. Switch to a larger EC2 instance type for the application servers on these high-traffic days. B. Utilize AWS Auto Scaling to automatically adjust the number of EC2 instances based on the load. C. Increase the provisioned IOPS for the Amazon RDS database instances during peak traffic. D. Migrate the application to a single EC2 instance with maximum compute and memory capacity. 3. You are designing an environment for a client that will be a hybrid environment between the on-prem and cloud environments. This new environment will have public and private subnets, as some resources will need internet access. However, some instances in your private subnets require anonymous access to the internet, so you have decided to configure NAT gateways for this purpose. What configuration steps must be taken to enable internet access for instances in the private subnets via the NAT gateways? (Select TWO) A. Disable source/destination checks on the NAT gateway. B. Disable source/destination checks on the public subnet. C. Allocate an Elastic IP address and associate it with the NAT Gateway. D. Create a route in the route table to direct traffic from the private subnet to the NAT Gateway.