SAA-C03 Question 36
Select 3A company is migrating its on-premises application to AWS. The application processes sensitive customer data and must comply with strict regulatory requirements. The application uses an Amazon EC2 instance to host the backend and stores data in an Amazon S3 bucket. As a Solutions Architect, how can you ensure that the workload is secure and meets compliance requirements?
- A
Enable server-side encryption (SSE) for the Amazon S3 bucket to encrypt customer data at rest.
- B
Use AWS Key Management Service (AWS KMS) to manage encryption keys for the S3 bucket.
- C
Attach an IAM policy to the EC2 instance role that grants full S3 bucket access to all users.
- D
Use AWS Systems Manager Session Manager to securely access the EC2 instance without opening SSH ports.
- E
Set up S3 bucket policies to allow public read access for quick data sharing.
Show answer and explanation
Correct answers: A, B, D
Explanation
To design secure workloads and applications, it is essential to enforce encryption for data at rest and in transit, minimize attack surfaces, and apply the principle of least privilege. Enabling server-side encryption for S3, using AWS KMS, and leveraging AWS Systems Manager for secure EC2 instance access all contribute to securing the workload and meeting compliance requirements. Avoid granting excessive permissions or exposing sensitive data to the public, as these practices can lead to security vulnerabilities.
- A. Correct.
This is correct. Enabling server-side encryption ensures that the data stored in the S3 bucket is encrypted at rest, which is critical for securing sensitive customer data.
- B. Correct.
This is correct. Using AWS KMS provides centralized key management and control, enhancing data protection and compliance with regulatory requirements.
- C. Incorrect.
This is incorrect. Granting full S3 bucket access to all users violates the principle of least privilege and could expose sensitive data.
- D. Correct.
This is correct. AWS Systems Manager Session Manager provides a secure way to access EC2 instances without requiring open SSH ports, reducing the attack surface.
- E. Incorrect.
This is incorrect. Allowing public read access to the S3 bucket would expose sensitive customer data and is not secure.