SAA-C03 Question 12
Select 3A company is designing a new web application that will be hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive customer data in an Amazon RDS database. The solution must ensure that data is encrypted both in transit and at rest. What combination of steps should the Solutions Architect take to meet this requirement?
- A
Enable SSL/TLS on the Application Load Balancer (ALB) and use an HTTPS listener.
- B
Configure the EC2 instances to use an encrypted Amazon EBS volume.
- C
Use AWS Key Management Service (AWS KMS) to enable encryption for the Amazon RDS database.
- D
Enable server-side encryption (SSE) on the Amazon S3 bucket used by the application.
- E
Configure a WAF (Web Application Firewall) to protect the web application from attacks.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the requirement of encrypting data in transit and at rest, the architect must enable SSL/TLS on the Application Load Balancer to encrypt data in transit and configure encryption for data at rest. This includes using encrypted EBS volumes for EC2 instances and enabling RDS encryption with AWS KMS. Options involving S3 SSE and WAF do not directly address the encryption requirements in this scenario.
- A. Correct.
Correct. Enabling SSL/TLS on the ALB ensures that data is encrypted in transit between the clients and the load balancer.
- B. Correct.
Correct. Using encrypted EBS volumes ensures that the data stored on the EC2 instances is encrypted at rest.
- C. Correct.
Correct. Using AWS KMS to enable RDS encryption ensures that the sensitive data in the database is encrypted at rest.
- D. Incorrect.
Incorrect. While enabling server-side encryption on an S3 bucket is a good practice, this scenario does not involve S3 storage for sensitive customer data.
- E. Incorrect.
Incorrect. Configuring a WAF enhances the security of the web application but does not address encryption of data in transit or at rest.