SAA-C03 Question 1
Select 3A company is designing a web application that stores sensitive customer data. The application is hosted on Amazon EC2 instances within a private subnet, and the data is stored in an Amazon RDS database. The company wants to ensure data security by encrypting data both at rest and in transit. Which combination of steps should be implemented to achieve this goal?
- A
Enable encryption for the RDS database at the time of creation.
- B
Use an Application Load Balancer (ALB) with HTTPS listeners to terminate SSL/TLS connections.
- C
Enable server-side encryption (SSE) on the EC2 instance root volume using AWS KMS.
- D
Configure the application to use SSL/TLS to connect to the RDS database.
- E
Use security groups to block all inbound traffic to the EC2 instances.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure data security in the given scenario, the company must encrypt data both at rest and in transit. Enabling encryption for the RDS database ensures that data stored in the database is encrypted at rest. Using an Application Load Balancer (ALB) with HTTPS listeners encrypts data in transit between the client and the ALB. Configuring the application to use SSL/TLS for connections to the RDS database secures data in transit between the application and the database. While server-side encryption on EC2 instances and security group rules are important, they do not directly address the encryption requirements for this scenario.
- A. Correct.
This is correct. Amazon RDS provides encryption at rest using AWS Key Management Service (KMS). Enabling encryption at the time of database creation ensures that all data stored in the database is encrypted.
- B. Correct.
This is correct. Using an Application Load Balancer (ALB) with HTTPS listeners ensures that data in transit between the client and the ALB is encrypted using SSL/TLS.
- C. Incorrect.
This is incorrect. While enabling server-side encryption (SSE) on the root volume encrypts data on the EC2 instance, it does not secure data in transit or the RDS database.
- D. Correct.
This is correct. Configuring the application to use SSL/TLS when connecting to the RDS database encrypts data in transit between the application and the database.
- E. Incorrect.
This is incorrect. Security groups are used to control network access but do not provide encryption capabilities for data at rest or in transit.