SAA-C03 Question 3
Select 3A company is designing a new web application that will store sensitive customer information in an Amazon RDS database. The company wants to ensure data security by encrypting the data at rest and in transit. Additionally, the company must meet compliance requirements by controlling database access at the network level. Which combination of actions should the Solutions Architect recommend?
- A
Enable encryption at rest for the Amazon RDS instance using AWS KMS.
- B
Use a VPC security group to restrict access to the RDS instance.
- C
Enable AWS Shield to protect the RDS database against DDoS attacks.
- D
Require SSL/TLS for database connections to encrypt data in transit.
- E
Use Amazon RDS Multi-AZ deployment to ensure high availability.
Show answer and explanation
Correct answers: A, B, D
Explanation
To design a secure architecture for the web application, the company must ensure that the data is protected both at rest and in transit. Enabling encryption at rest with AWS KMS and requiring SSL/TLS for database connections satisfy these requirements. Additionally, using a VPC security group ensures that access to the database is controlled at the network level. AWS Shield and Multi-AZ deployment are important for other use cases, such as availability and DDoS protection, but they are not directly relevant to the encryption and network security requirements described in this scenario.
- A. Correct.
Enabling encryption at rest using AWS KMS ensures that the data stored in the database is encrypted, which addresses the security and compliance requirement.
- B. Correct.
Using a VPC security group allows you to control network-level access to the RDS instance, which is necessary for securing the database and meeting compliance requirements.
- C. Incorrect.
AWS Shield is a service designed to protect against DDoS attacks, but it does not provide encryption or network-level access control for the RDS database.
- D. Correct.
Enabling SSL/TLS for database connections encrypts data in transit, ensuring sensitive information is securely transmitted to and from the RDS database.
- E. Incorrect.
While Amazon RDS Multi-AZ deployment provides high availability and fault tolerance, it does not directly address encryption or network-level access control.