SAP-C02 Question 399
Select 3An organization has an application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application handles sensitive user data, and the company is concerned about improving its security posture. As a Solutions Architect, which steps should you implement to enhance security for this application?
- A
Enable AWS WAF on the Application Load Balancer to block malicious traffic patterns.
- B
Use Amazon GuardDuty to monitor and block suspicious activity on the EC2 instances.
- C
Implement encryption in transit by configuring HTTPS on the ALB using an ACM-provided SSL/TLS certificate.
- D
Store sensitive data in Amazon S3 and enable server-side encryption with customer-provided keys (SSE-C).
- E
Configure security groups to allow only necessary inbound traffic to the EC2 instances.
Show answer and explanation
Correct answers: A, C, E
Explanation
To improve the security of the application, a multi-layered approach is required. Enabling AWS WAF on the ALB helps block malicious traffic patterns, while configuring HTTPS ensures data is encrypted in transit. Restricting inbound traffic to only necessary sources via security groups minimizes the attack surface. GuardDuty is useful for monitoring but does not directly enhance the security of the application, and while server-side encryption with SSE-C is good for data at rest, it does not directly apply to this EC2-hosted application scenario.
- A. Correct.
Enabling AWS WAF on the ALB adds a layer of security by allowing you to define rules to block malicious traffic, such as SQL injection and cross-site scripting attacks.
- B. Incorrect.
Amazon GuardDuty is a threat detection service that provides monitoring but does not directly block activity. It is useful for threat intelligence but not for proactive security in this scenario.
- C. Correct.
Configuring HTTPS on the ALB ensures encryption in transit, protecting sensitive data as it is transmitted between clients and the application.
- D. Incorrect.
Using server-side encryption with customer-provided keys (SSE-C) in Amazon S3 is a good practice for securing data at rest, but it is irrelevant for improving the security of the EC2-hosted application in this scenario.
- E. Correct.
Configuring security groups to allow only necessary inbound traffic reduces the attack surface of the EC2 instances and is a fundamental security practice.