SAP-C02 Question 44
Select 3Your company is building a multi-tier web application that processes sensitive customer data. The application consists of an Amazon EC2-based web tier, an application tier running on AWS Lambda, and an Amazon RDS database. To meet compliance requirements, you must ensure that all data is encrypted both in transit and at rest. Additionally, only specific users from your security team should be able to access encryption keys. Which combination of security controls should you implement to meet these requirements?
- A
Use AWS Key Management Service (KMS) to manage encryption keys and define IAM policies to restrict key access
- B
Enable Transparent Data Encryption (TDE) for Amazon RDS to encrypt data at rest
- C
Use an Application Load Balancer (ALB) with an HTTPS listener to enforce encryption in transit
- D
Store encryption keys in a self-managed HSM cluster to retain complete control over key access
- E
Enable VPC traffic mirroring to monitor and secure in-transit data
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the compliance requirements of encrypting sensitive customer data both in transit and at rest, you should use AWS KMS for managing and restricting access to encryption keys, enable Transparent Data Encryption (TDE) for Amazon RDS to encrypt data at rest, and use an Application Load Balancer (ALB) with HTTPS listeners to enforce encryption for data in transit. Storing encryption keys in a self-managed HSM or enabling VPC traffic mirroring does not directly address the compliance requirements in the most efficient or AWS-native way.
- A. Correct.
Correct: AWS Key Management Service (KMS) is a fully managed service that allows you to create and control encryption keys. You can define IAM policies to restrict key access to specific users or roles, which aligns with the requirement to limit key access to the security team.
- B. Correct.
Correct: Transparent Data Encryption (TDE) is a feature provided by Amazon RDS for encrypting data at rest. This satisfies the requirement to encrypt data stored in the database.
- C. Correct.
Correct: Using an Application Load Balancer (ALB) with an HTTPS listener ensures that all traffic between clients and the web tier is encrypted in transit, meeting the compliance requirement.
- D. Incorrect.
Incorrect: While a self-managed HSM cluster offers complete control over encryption keys, it adds operational overhead and does not leverage AWS-native capabilities like KMS, which is more suitable for this use case.
- E. Incorrect.
Incorrect: VPC traffic mirroring is a tool for analyzing and monitoring network traffic but does not provide encryption for data in transit or at rest.