DOP-C02 Question 312
Select 3Your organization is running a critical web application hosted on Amazon ECS using the Fargate launch type. The application requires strict compliance with organizational security policies, including logging all network traffic and ensuring encryption in transit. You are tasked with designing a solution to meet these requirements. Which combination of steps will help you achieve this?
- A
Enable VPC Flow Logs for the ECS service's VPC to capture network traffic.
- B
Configure an Application Load Balancer (ALB) with an HTTPS listener using a valid SSL/TLS certificate.
- C
Enable server-side encryption for Amazon S3 buckets where ECS logs are stored.
- D
Add a security group to the ECS task that allows unrestricted inbound and outbound traffic.
- E
Use AWS Secrets Manager to store sensitive configuration data for the ECS task.
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet the requirements of logging all network traffic and ensuring encryption in transit, enabling VPC Flow Logs captures detailed network traffic information, while configuring an ALB with HTTPS ensures secure communication. Additionally, using AWS Secrets Manager for sensitive configuration data enhances overall security compliance. Server-side encryption for S3, though a good practice, is not directly related to the scenario's requirements. Allowing unrestricted traffic violates security policies.
- A. Correct.
Enabling VPC Flow Logs captures network traffic for the VPC and helps in monitoring and compliance, which is necessary for meeting organizational security requirements.
- B. Correct.
Configuring an ALB with an HTTPS listener ensures encryption in transit for the application traffic, which is a critical security requirement.
- C. Incorrect.
While enabling server-side encryption for S3 is a good practice, it is not directly relevant to the specific requirements of logging all network traffic and ensuring encryption in transit.
- D. Incorrect.
Allowing unrestricted inbound and outbound traffic violates security best practices and does not meet the strict security policies of the organization.
- E. Correct.
Using AWS Secrets Manager is a secure way to store sensitive configuration data, aligning with security best practices.