SAP-C02 Question 213
Select 3Your organization plans to deploy a web application on AWS, which processes sensitive customer data. The security team requires that the application encrypt data at rest and enforce strong access controls. Additionally, compliance mandates require monitoring of access to sensitive data. Which combination of AWS security controls should you implement?
- A
Use AWS Key Management Service (KMS) to manage encryption keys and enable server-side encryption for storage services such as Amazon S3 and Amazon RDS.
- B
Use AWS Secrets Manager to store and rotate database credentials securely.
- C
Enable VPC Flow Logs to monitor all traffic entering and leaving the application.
- D
Use AWS Identity and Access Management (IAM) to enforce least privilege access policies for users and roles.
- E
Enable AWS CloudTrail to log and monitor access to the application and sensitive data.
Show answer and explanation
Correct answers: A, D, E
Explanation
To meet the requirements of encrypting data at rest, enforcing strong access controls, and monitoring access to sensitive data, a combination of AWS KMS, IAM least privilege policies, and AWS CloudTrail logging is required. KMS ensures data is encrypted at rest, IAM enforces strict access controls, and CloudTrail logs API-level access to sensitive resources for compliance monitoring. Other options like AWS Secrets Manager and VPC Flow Logs, while useful in other scenarios, do not directly address the requirements outlined in this question.
- A. Correct.
Correct: AWS KMS allows you to securely manage encryption keys, and enabling server-side encryption ensures data at rest is encrypted, meeting the requirement for encryption.
- B. Incorrect.
Incorrect: AWS Secrets Manager is useful for managing secrets like database credentials, but it does not directly address encryption at rest or access monitoring, which are key requirements in this scenario.
- C. Incorrect.
Incorrect: While VPC Flow Logs monitor traffic at the network level, they do not monitor application-level access to sensitive data as required by compliance mandates.
- D. Correct.
Correct: Using IAM to enforce least privilege access controls ensures that users and roles only have the permissions they need, addressing the strong access control requirement.
- E. Correct.
Correct: AWS CloudTrail provides logging and monitoring capabilities for API activity, which helps meet compliance mandates requiring access monitoring for sensitive data.