ANS-C01 Question 495
Select 3Your company has deployed a mission-critical application on AWS that handles sensitive financial data. To ensure compliance with security policies, you need to utilize end-to-end encryption for data in transit between clients and backend resources. Which of the following network encryption options can be used to achieve this requirement?
- A
Configure an Application Load Balancer (ALB) with HTTPS listeners and SSL certificates managed by AWS Certificate Manager (ACM)
- B
Enable server-side encryption on Amazon S3 buckets used by the application
- C
Use AWS Client VPN with mutual authentication (certificate-based) to establish secure communication
- D
Implement a Transit Gateway with AWS Site-to-Site VPN for encrypted communication between on-premises and AWS resources
- E
Set up VPC Traffic Mirroring to monitor traffic for sensitive data leaks
Show answer and explanation
Correct answers: A, C, D
Explanation
To ensure secure data in transit, options like HTTPS with ALB, AWS Client VPN, and AWS Site-to-Site VPN provide encryption mechanisms that protect sensitive information during transmission. Server-side encryption and traffic monitoring tools like VPC Traffic Mirroring are not designed for encrypting data in transit and therefore do not meet the requirements of this scenario.
- A. Correct.
Correct: Configuring an ALB with HTTPS listeners ensures encryption in transit between clients and the load balancer using SSL/TLS. AWS Certificate Manager (ACM) simplifies certificate management.
- B. Incorrect.
Incorrect: Server-side encryption on S3 only applies to data at rest, not data in transit, which is the requirement in this scenario.
- C. Correct.
Correct: AWS Client VPN with mutual authentication provides encrypted communication between client devices and AWS resources, meeting the requirement for secure data in transit.
- D. Correct.
Correct: Transit Gateway with AWS Site-to-Site VPN creates encrypted tunnels to connect on-premises networks to AWS, ensuring secure communication for data in transit.
- E. Incorrect.
Incorrect: VPC Traffic Mirroring is a monitoring tool that captures network traffic for analysis but does not provide encryption for data in transit.