SAP-C02 Question 235
Select 3You are designing a multi-tier web application that stores sensitive customer data in an Amazon RDS database. The application also communicates with external APIs over the internet. Compliance requirements mandate that all data should be encrypted both at rest and in transit. Which combination of solutions will meet these requirements?
- A
Enable Amazon RDS encryption at rest using AWS Key Management Service (KMS).
- B
Use SSL/TLS to secure communication between the application and external APIs.
- C
Encrypt the RDS database backups manually before storing them in Amazon S3.
- D
Use AWS Certificate Manager (ACM) to provision and manage SSL/TLS certificates for the application.
- E
Enable S3 default encryption to automatically encrypt the data in transit.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the compliance requirements for encrypting data at rest and in transit, you must enable RDS encryption at rest using AWS KMS, use SSL/TLS for secure communication with external APIs, and manage SSL/TLS certificates for the application using AWS Certificate Manager (ACM). Encrypting database backups manually or enabling S3 default encryption does not address the scenario requirements.
- A. Correct.
This is correct. Enabling Amazon RDS encryption at rest using AWS KMS ensures that the sensitive customer data stored in the RDS database is encrypted.
- B. Correct.
This is correct. Using SSL/TLS ensures that data in transit between the application and external APIs is encrypted, meeting compliance requirements.
- C. Incorrect.
This is incorrect. While encrypting database backups is important, RDS automatically encrypts backups when RDS encryption is enabled. There is no need for manual encryption.
- D. Correct.
This is correct. AWS Certificate Manager (ACM) simplifies the provisioning and management of SSL/TLS certificates, ensuring secure communication for the application.
- E. Incorrect.
This is incorrect. S3 default encryption secures data at rest, not data in transit. It does not apply to this scenario.