ANS-C01 Question 455
Select 3Your company needs to design an AWS network architecture for a new application that processes sensitive financial data. The architecture must comply with strict security and regulatory requirements, including data encryption in transit, private network access only, and centralized logging for network traffic. Which combination of AWS services and configurations would meet these requirements?
- A
Use VPC endpoints to privately access AWS services without exposing the traffic to the public internet.
- B
Enable VPC Flow Logs to capture and analyze network traffic for compliance and monitoring.
- C
Use an Internet Gateway to allow the application servers to communicate with external services over the internet.
- D
Configure Network ACLs and Security Groups to enforce fine-grained access control within the VPC.
- E
Use AWS WAF (Web Application Firewall) to block unauthorized access to the application servers within the VPC.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the security and compliance requirements for processing sensitive financial data, the architecture should ensure private network access (using VPC endpoints), centralized logging (using VPC Flow Logs), and fine-grained access control (using Network ACLs and Security Groups). An Internet Gateway and AWS WAF, while useful for other scenarios, do not align with the specific requirements of this use case.
- A. Correct.
Correct: VPC endpoints enable secure, private communication to AWS services without exposing traffic to the public internet, which aligns with compliance and security requirements.
- B. Correct.
Correct: VPC Flow Logs provide detailed logging of network traffic, which is essential for auditing and meeting regulatory compliance requirements.
- C. Incorrect.
Incorrect: While an Internet Gateway allows communication with the internet, it does not align with the requirement for private network access only. It would expose traffic to the public internet.
- D. Correct.
Correct: Network ACLs and Security Groups provide the necessary fine-grained control over inbound and outbound traffic, meeting security requirements.
- E. Incorrect.
Incorrect: While AWS WAF helps protect web applications from common web exploits, it does not fulfill the stated requirements for private network access or centralized logging.