A web application is hosted on AWS using an Elastic Load Balancer, multiple Amazon EC2 instances, and Amazon RDS.
Which security measures fall under the responsibility of AWS? (Choose two.)

A. Running a virus scan on EC2 instances
B. Protecting against IP spoofing and packet sniffing
C. Installing the latest security patches on the RDS instance
D. Encrypting communication between the EC2 instances and the Elastic Load Balancer
E. Configuring a security group and a network access control list (NACL) for EC2 instances