A company plans to migrate applications to a single AWS Region using Amazon EC2, Elastic Load Balancing (ELB), and Amazon S3. The migration must be completed quickly and must meet the following: data encrypted at rest, data encrypted in transit, and endpoints monitored for anomalous network activity. Which combination of actions should a security engineer take with the least effort? (Choose three.)

Enabling Amazon GuardDuty provides intelligent threat detection and continuous monitoring for anomalous network activity, fulfilling the monitoring requirement with minimal effort. Using AWS Certificate Manager (ACM) and configuring ELB to use ACM certificates ensures data encryption in transit. ACM handles certificate provisioning and renewal, simplifying management. For data encryption at rest in S3, using AWS KMS for key management and enforcing server-side encryption with a bucket policy that denies PutObject requests without the x-amz-server-side-encryption header guarantees that all objects are encrypted. Incorrect options: Installing the Amazon Inspector agent is for vulnerability assessment of EC2 instances, not primarily for anomalous network activity monitoring, and requires agent management. GuardDuty is a managed service for network anomaly detection. Creating VPC endpoints for EC2 and S3 is a good security practice but doesn't directly address the specific requirements of anomalous network activity monitoring or data encryption in transit/at rest as efficiently as the chosen options. The x-amz-meta-side-encryption condition is not a standard S3 header for server-side encryption enforcement; x-amz-server-side-encryption is the correct header.