SAA-C03 Question 33
Select 3A company is building a web application that stores sensitive customer data in an Amazon RDS database. The application is hosted on Amazon EC2 instances behind an Application Load Balancer. The company needs to ensure the application is designed securely and minimizes the risk of data breaches. Which of the following design choices should be implemented to achieve this?
- A
Enable encryption at rest for the Amazon RDS database.
- B
Use an Application Load Balancer with SSL/TLS termination to encrypt traffic between clients and the load balancer.
- C
Grant EC2 instances direct public internet access to simplify database access.
- D
Use security groups to restrict database access to the application instances only.
- E
Store database credentials as plaintext environment variables on EC2 instances.
Show answer and explanation
Correct answers: A, B, D
Explanation
To design secure workloads and applications, you must ensure data is encrypted both at rest and in transit. Access to sensitive resources like databases should be tightly controlled using security groups and private networking. Additionally, secrets such as database credentials should be managed securely using AWS services designed for this purpose. Following these practices helps minimize the risk of data breaches and unauthorized access.
- A. Correct.
Correct: Enabling encryption at rest for Amazon RDS ensures sensitive data is encrypted when stored on disk, which is a fundamental security best practice.
- B. Correct.
Correct: Using SSL/TLS termination on the Application Load Balancer ensures data is encrypted during transmission between the clients and the load balancer, protecting data in transit.
- C. Incorrect.
Incorrect: Granting EC2 instances direct public internet access increases the attack surface and violates security best practices. Access should be restricted using private subnets and security groups.
- D. Correct.
Correct: Security groups should be used to restrict database access to only the application instances, reducing the risk of unauthorized access.
- E. Incorrect.
Incorrect: Storing database credentials as plaintext environment variables is insecure. Instead, use AWS Secrets Manager or Systems Manager Parameter Store to securely manage credentials.