SAP-C02 Question 424
Select 3Your company is planning to migrate a critical application to AWS, and the security team has raised concerns about protecting sensitive data in transit and at rest while meeting compliance requirements. The application uses an RDS database for backend storage and communicates with other services via an API Gateway. Which combination of AWS security solutions should you implement to address these concerns?
- A
Enable encryption at rest for the RDS database using AWS KMS
- B
Use Amazon Macie to continuously monitor the RDS database for sensitive data
- C
Enforce HTTPS-only communication for the API Gateway
- D
Use AWS Secrets Manager to manage and rotate database credentials
- E
Enable AWS Shield Advanced to protect the application from DDoS attacks
Show answer and explanation
Correct answers: A, C, D
Explanation
To address the security concerns of protecting sensitive data in transit and at rest, you should enable encryption for the RDS database using AWS KMS, enforce HTTPS-only communication for API Gateway to secure data in transit, and use AWS Secrets Manager to securely manage database credentials. These measures directly address the requirements for securing sensitive data while maintaining compliance. Amazon Macie and AWS Shield Advanced, while valuable for other use cases, do not specifically address the encryption or credential management concerns in this scenario.
- A. Correct.
This is correct. Enabling encryption at rest for the RDS database using AWS KMS ensures that sensitive data stored in the database is encrypted, addressing concerns about data at rest.
- B. Incorrect.
This is incorrect. While Amazon Macie is a data security service, it is primarily used to discover and classify sensitive data in Amazon S3 buckets, not to monitor RDS databases.
- C. Correct.
This is correct. Enforcing HTTPS-only communication for the API Gateway ensures that all data in transit between the application and clients is encrypted, addressing concerns about data in transit.
- D. Correct.
This is correct. AWS Secrets Manager helps securely manage and rotate database credentials, which is an essential security measure for protecting backend resources like the RDS database.
- E. Incorrect.
This is incorrect. While AWS Shield Advanced provides DDoS protection, it does not directly address the concerns of encrypting data in transit and at rest or managing sensitive data.