A team is choosing traffic controls for resources in an Amazon VPC. Which TWO statements correctly describe security groups and network ACLs? Select TWO.

1. Both controls automatically encrypt all application data at rest.
2. Security groups provide stateful traffic filtering for associated resources.
3. Security groups provide DNS name registration for public domains.
4. Network ACLs replace IAM permissions for S3 API calls.
5. Network ACLs provide stateless traffic filtering at the subnet boundary.