SAA-C03 Question 34
Select 2Your company is deploying a web application on AWS that handles sensitive customer data. To meet security compliance requirements, you need to ensure that the workload is secure and that the data remains encrypted both at rest and in transit. Which of the following actions should you take? (Select TWO.)
- A
Use Amazon S3 with server-side encryption for storing sensitive data.
- B
Use AWS Certificate Manager to provision and manage SSL/TLS certificates for HTTPS communication.
- C
Store sensitive data in Amazon EC2 instance storage for faster processing.
- D
Disable security groups temporarily to allow unrestricted access during testing.
- E
Configure S3 bucket policies to allow public read access for troubleshooting purposes.
Show answer and explanation
Correct answers: A, B
Explanation
To design secure workloads and applications, it is critical to encrypt sensitive data both at rest and in transit. Using Amazon S3 with server-side encryption protects data at rest, while AWS Certificate Manager ensures secure HTTPS communication, protecting data in transit. Options 3, 4, and 5 introduce security vulnerabilities or fail to meet encryption requirements, making them unsuitable for this scenario.
- A. Correct.
This is correct because Amazon S3 server-side encryption ensures that data is encrypted at rest, satisfying part of the security compliance requirement.
- B. Correct.
This is correct because AWS Certificate Manager (ACM) provides SSL/TLS certificates to enable secure HTTPS communication, ensuring data is encrypted in transit.
- C. Incorrect.
This is incorrect because Amazon EC2 instance storage is ephemeral and does not offer built-in encryption by default, making it unsuitable for storing sensitive data.
- D. Incorrect.
This is incorrect because disabling security groups would expose your application to potential security threats, which is not compliant with security best practices.
- E. Incorrect.
This is incorrect because allowing public read access to an S3 bucket would expose sensitive data to unauthorized users, violating security compliance requirements.