ANS-C01 Question 508
Select 3You are designing a secure communication solution for an application running on Amazon EC2 instances that need to transmit sensitive data to an on-premises environment. Under the AWS shared responsibility model, which actions are your responsibility as a customer to ensure network encryption is properly implemented?
- A
Configuring a VPN connection between the on-premises environment and the AWS environment with encryption enabled
- B
Ensuring that TLS certificates for the application are properly installed and managed on the EC2 instances
- C
Enabling server-side encryption for S3 buckets used by the application
- D
Managing the security of the underlying AWS global network used for data transmission
- E
Implementing application-layer encryption for sensitive data before it is transmitted
Show answer and explanation
Correct answers: A, B, E
Explanation
Under the AWS shared responsibility model, AWS is responsible for securing the underlying infrastructure, while customers are responsible for securing their workloads and data, including implementing appropriate encryption mechanisms. Customers must configure VPNs or other secure connections, manage TLS certificates for in-transit encryption at the application layer, and apply application-layer encryption to sensitive data. AWS takes care of the security of its global infrastructure, but securing data in-transit and implementing encryption mechanisms at the application level are the customer's responsibilities.
- A. Correct.
Correct. Under the shared responsibility model, customers are responsible for configuring VPN connections and ensuring data is encrypted in-transit when transmitted between AWS and on-premises environments.
- B. Correct.
Correct. TLS certificates used for encrypting data in-transit at the application layer are the customer's responsibility, as they are part of securing their application workloads on EC2.
- C. Incorrect.
Incorrect. While enabling server-side encryption for S3 is a good practice, it is not directly related to securing network transmissions, which is the focus of this question.
- D. Incorrect.
Incorrect. AWS is responsible for the security of its global network, including the infrastructure that underpins data transmission. This is not the customer's responsibility.
- E. Correct.
Correct. Application-layer encryption is the customer's responsibility as part of ensuring sensitive data is encrypted before it is transmitted over the network.