On-premises devices retrieve configuration files from an Amazon EFS filesystem over a Direct Connect link. Traffic must remain private and encrypted, devices must follow least-privilege AWS access, and operators need to revoke access for a single device without impacting others. Which steps satisfy these requirements? (Choose two.)

The combination of IAM Roles Anywhere and amazon-efs-utils provides a secure, scalable, and manageable solution. IAM Roles Anywhere allows on-premises servers to use X.509 certificates to authenticate with AWS and assume IAM roles, providing temporary credentials and adhering to least privilege. Issuing device-specific certificates from AWS Private CA and associating them with individual profiles in IAM Roles Anywhere enables granular access control and easy revocation for a single device without affecting others. The amazon-efs-utils package is crucial for mounting EFS, as it supports EFS-specific features like IAM authentication for data in transit encryption, ensuring traffic remains private and encrypted. Using IAM users with access keys (incorrect option 1 and 3) is less secure than temporary credentials from IAM Roles Anywhere, as access keys are long-lived and harder to rotate or revoke granularly per device. A single IAM user for all devices (incorrect option 3) violates the principle of least privilege and prevents individual device revocation. Mounting with the native Linux NFS client (incorrect option 5) does not support IAM authentication for EFS, which is necessary for encrypting data in transit and enforcing AWS access policies.