ANS-C01 Question 486
Select 3Your organization runs a multi-region web application on AWS, and you need to ensure that all data transmitted between the application clients and the backend servers is encrypted in transit. Additionally, you want to secure inter-region communications between your VPCs. Which combination of actions should you take to implement and maintain data confidentiality across the network?
- A
Use TLS certificates issued by AWS Certificate Manager (ACM) to secure communications between application clients and backend servers.
- B
Enable VPC Peering between the VPCs in different regions to ensure secure inter-region communication.
- C
Set up an AWS Transit Gateway with IPsec VPN connections to encrypt inter-region traffic between VPCs.
- D
Configure Application Load Balancers (ALBs) to terminate HTTPS connections and enforce TLS 1.2 or higher.
- E
Enable Amazon Macie to scan network traffic for sensitive data and automatically encrypt it.
Show answer and explanation
Correct answers: A, C, D
Explanation
To maintain data confidentiality across the network, you need to secure both client-to-server and inter-region communications. Using TLS certificates from ACM secures client-to-server communication. Implementing AWS Transit Gateway with IPsec VPN ensures encrypted inter-region traffic. Additionally, enforcing HTTPS and TLS 1.2 or higher on ALBs ensures secure communications with the application. VPC Peering alone does not encrypt traffic, and Amazon Macie does not handle network traffic encryption.
- A. Correct.
Correct. Using TLS certificates issued by ACM ensures that data between clients and backend servers is encrypted in transit, maintaining confidentiality.
- B. Incorrect.
Incorrect. While VPC Peering provides private connectivity between VPCs, it does not encrypt inter-region traffic by default, so it does not ensure confidentiality.
- C. Correct.
Correct. AWS Transit Gateway with IPsec VPN connections allows secure, encrypted communication between VPCs across regions.
- D. Correct.
Correct. Configuring ALBs to terminate HTTPS connections and enforcing TLS 1.2 or higher ensures secure and encrypted communication between clients and the application.
- E. Incorrect.
Incorrect. Amazon Macie is a security service for identifying sensitive data, but it does not encrypt network traffic or ensure confidentiality.