Customers are responsible for protecting their network traffic, such as using encryption, security groups, and network ACLs and AWS manages the physical networking infrastructure inside its Regions and Availability Zones are correct.

The first correct statement is true because customers control and must configure how their data moves and is protected in the cloud and that includes choosing and implementing TLS, managing security group rules, and using network ACLs to control traffic flows. These controls are part of the customer responsibilities for securing resources and data in their account.

The second correct statement is true because AWS operates and secures the underlying physical network devices and the connectivity that form each Region and Availability Zone, and AWS is responsible for the physical infrastructure layer of the cloud.

Customers administer the physical compute hardware that runs AWS services is incorrect because customers do not manage the data center hosts or server hardware, and AWS owns and maintains the physical compute resources that support managed services.

AWS configures a customer's VPC security groups and network ACL rules is incorrect because VPC firewall rules are defined and maintained by the customer as part of security in the cloud and AWS does not set those account level configurations for you.

AWS automatically encrypts all application network traffic for customers without any setup is incorrect because encryption in transit generally requires the customer to enable or configure protocols such as TLS or to use managed features that must be chosen and set up by the customer.

Full AWS Practitioner Certification Question