SAP-C02 Question 217
Select 3An e-commerce company is planning to deploy a new web application on AWS that will process sensitive customer data, including Personally Identifiable Information (PII). The application will include an Amazon RDS database for storing the data and an Amazon S3 bucket for storing transaction logs. The company's compliance team has mandated that all sensitive data must be encrypted at rest and in transit, and unauthorized access must be strictly controlled. As the Solutions Architect, what security controls should you implement to meet these requirements?
- A
Enable encryption at rest for the Amazon RDS database and Amazon S3 bucket using AWS managed keys (SSE-S3 and AWS KMS).
- B
Use AWS Key Management Service (KMS) customer-managed keys to encrypt sensitive data in the Amazon RDS database and Amazon S3 bucket.
- C
Enable default encryption for Amazon S3 and configure bucket policies to deny any requests that are not encrypted.
- D
Require all database connections to use SSL/TLS to encrypt data in transit.
- E
Create an IAM role with full access to the Amazon S3 bucket and attach it to the application’s EC2 instance.
Show answer and explanation
Correct answers: B, C, D
Explanation
To meet the compliance requirements for handling sensitive PII data, you should implement encryption at rest using AWS KMS customer-managed keys for both Amazon RDS and Amazon S3, enforce bucket policies for encryption in S3, and ensure SSL/TLS is used for database connections to encrypt data in transit. These controls provide robust security for sensitive data and adhere to compliance requirements. Granting full access to the S3 bucket to an EC2 instance violates the principle of least privilege and could expose sensitive data to unauthorized access.
- A. Incorrect.
Enabling encryption at rest with AWS managed keys (SSE-S3 and AWS KMS) is a valid approach but does not provide the highest level of control and compliance compared to customer-managed keys. For sensitive PII data, customer-managed keys are typically preferred.
- B. Correct.
Using AWS Key Management Service (KMS) customer-managed keys ensures a higher level of control over encryption and key management, which is critical for sensitive data such as PII.
- C. Correct.
Enabling default encryption for Amazon S3 and configuring bucket policies to enforce encryption ensures that all data in the S3 bucket is encrypted, meeting compliance requirements.
- D. Correct.
Requiring SSL/TLS for database connections ensures data is encrypted in transit, fulfilling the requirement for encryption during data transmission.
- E. Incorrect.
Giving full access to the S3 bucket to an EC2 instance is not aligned with the principle of least privilege, which is essential for securing sensitive data.