A company runs a public website on an Amazon EC2 instance. The site must be accessible over HTTPS, and administrators use SSH for server management. The website is in subnet 10.0.1.0/24, and administration occurs from subnet 192.168.100.0/24. You need to create the instance’s security group. Which actions should you take to meet the requirements in the most secure way? (Choose two.)

The correct actions are to allow inbound HTTPS (TCP 443) from 0.0.0.0/0 and inbound SSH (TCP 22) from 192.168.100.0/24. Allowing inbound HTTPS (TCP 443) from 0.0.0.0/0 is necessary because the website is public and must be accessible to all users on the internet. Restricting this port to a specific subnet would prevent public access. Allowing inbound SSH (TCP 22) from 192.168.100.0/24 is the most secure approach for administration. This restricts SSH access only to the specified administration subnet, minimizing the attack surface compared to allowing SSH from 0.0.0.0/0, which would expose it to the entire internet. Allowing inbound SSH (TCP 22) from 0.0.0.0/0 is incorrect because it is not the most secure way; it exposes the SSH port to the entire internet. Allowing inbound SSH (TCP 22) from 10.0.1.0/24 is incorrect because the administration subnet is 192.168.100.0/24, not 10.0.1.0/24. Allowing inbound HTTPS (TCP 443) from 10.0.1.0/24 is incorrect because the website needs to be publicly accessible, not just from its own subnet.