DOP-C02 Question 344
Select 3Your company operates a highly regulated application that processes sensitive customer data. The application runs on Amazon ECS with Fargate, and the company must comply with strict security and compliance standards, including encryption for data in transit, audit logging, and restricted network access. As a DevOps Engineer, what actions should you take to ensure the application is compliant with these security requirements?
- A
Configure an Application Load Balancer (ALB) with HTTPS listeners and enforce TLS 1.2 or higher for encrypting data in transit.
- B
Enable AWS WAF on the Application Load Balancer to protect against SQL injection and cross-site scripting attacks.
- C
Configure Fargate tasks to use a task execution role with permissions to store logs in Amazon CloudWatch Logs for auditing.
- D
Create a VPC endpoint for ECS and restrict task access to the public internet by configuring security groups and Network ACLs.
- E
Disable encryption for Amazon Elastic File System (EFS) volumes used by the ECS tasks to optimize application performance.
Show answer and explanation
Correct answers: A, C, D
Explanation
Ensuring compliance in a regulated environment requires addressing specific security controls such as encryption for data in transit, audit logging, and network isolation. Configuring HTTPS with TLS 1.2 or higher on the Application Load Balancer ensures data in transit is encrypted. Enabling CloudWatch Logs for ECS tasks provides the required auditing capabilities, while using a VPC endpoint and restricting public internet access ensures secure network isolation. Disabling encryption for EFS violates compliance requirements, and while AWS WAF is beneficial for application security, it is not directly linked to the listed compliance objectives.
- A. Correct.
Correct. Configuring an ALB with HTTPS listeners and enforcing TLS 1.2 or higher ensures encryption for data in transit, meeting compliance requirements.
- B. Incorrect.
Incorrect. While AWS WAF enhances security, it is unrelated to encryption, audit logging, or restricted network access, which are the primary compliance requirements in this scenario.
- C. Correct.
Correct. Logging task activity to CloudWatch Logs ensures auditing capabilities, which are essential for compliance in regulated environments.
- D. Correct.
Correct. Using a VPC endpoint for ECS and restricting access to the public internet enhances security by ensuring network isolation, meeting compliance requirements.
- E. Incorrect.
Incorrect. Disabling encryption for EFS volumes violates compliance requirements, as sensitive data must be encrypted both at rest and in transit.