ANS-C01 Question 507
Select 2A company hosts its application in an Amazon VPC and transfers sensitive customer data between its on-premises data center and AWS using an AWS Direct Connect connection. Under the AWS shared responsibility model, which of the following actions must the company take to ensure the data is encrypted during transit?
- A
Enable MACsec (Media Access Control Security) on the AWS Direct Connect connection.
- B
Use a VPN connection over AWS Direct Connect to encrypt the data.
- C
Rely on AWS to automatically encrypt all data transmitted over AWS Direct Connect.
- D
Implement application-layer encryption for sensitive data before transmission.
- E
Use AWS Key Management Service (KMS) to encrypt the data during transmission.
Show answer and explanation
Correct answers: B, D
Explanation
Under the AWS shared responsibility model, AWS is responsible for securing the underlying infrastructure, while the customer is responsible for securing their data, including encrypting data in transit. AWS Direct Connect does not provide encryption by default, so it is the customer's responsibility to use methods such as VPNs or application-layer encryption to secure sensitive data during transmission.
- A. Incorrect.
Enabling MACsec on AWS Direct Connect is not currently supported by AWS as of October 2023. The company would need to use other methods to secure data in transit over Direct Connect.
- B. Correct.
Using a VPN connection over AWS Direct Connect is a valid approach to encrypt data in transit. A VPN tunnel can provide encryption that Direct Connect alone does not offer.
- C. Incorrect.
AWS Direct Connect does not automatically encrypt data in transit. It is the customer's responsibility to implement encryption for data transmitted over Direct Connect.
- D. Correct.
Application-layer encryption ensures sensitive data is encrypted before transmission, which is the customer's responsibility under the shared responsibility model.
- E. Incorrect.
AWS KMS is a service for managing encryption keys, but it does not directly encrypt data during transmission. The customer must implement encryption mechanisms that utilize KMS-managed keys if needed.