SAP-C02 Question 447
Select 3A company is running an analytics platform on AWS that processes sensitive customer data. They are required to ensure that data is encrypted at rest and in transit, while maintaining minimal performance overhead. They currently use Amazon RDS for their database, Amazon S3 for storing raw data, and Amazon Elastic Load Balancer (ELB) to distribute traffic to their application instances. As a Solutions Architect, what combination of actions should you recommend to meet the encryption requirements?
- A
Enable Amazon RDS encryption and ensure the database is using an AWS Key Management Service (KMS) key.
- B
Enable S3 bucket default encryption using an AWS KMS-managed key (SSE-KMS).
- C
Configure the Elastic Load Balancer with an HTTPS listener and upload an SSL/TLS certificate using AWS Certificate Manager (ACM).
- D
Enable server-side encryption with customer-provided keys (SSE-C) for Amazon S3.
- E
Set up client-side encryption for all data before uploading to Amazon S3.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the encryption requirements, you need to ensure data is encrypted both at rest and in transit. Enabling Amazon RDS encryption with AWS KMS ensures data at rest in the database is secure. Configuring S3 bucket default encryption with SSE-KMS ensures raw data stored in S3 is encrypted at rest. Finally, using an HTTPS listener with an SSL/TLS certificate on the Elastic Load Balancer ensures encryption for data in transit. Options like SSE-C and client-side encryption are unnecessary when AWS-provided encryption methods are sufficient and easier to manage.
- A. Correct.
Correct. Enabling Amazon RDS encryption with an AWS KMS key ensures that data at rest in the database is encrypted as per the requirement.
- B. Correct.
Correct. Enabling S3 bucket default encryption with an AWS KMS-managed key (SSE-KMS) ensures all objects stored in the bucket are encrypted at rest.
- C. Correct.
Correct. Configuring the Elastic Load Balancer with an HTTPS listener and an SSL/TLS certificate ensures data in transit is encrypted between clients and the load balancer.
- D. Incorrect.
Incorrect. While SSE-C does encrypt data at rest in S3, it requires you to manage encryption keys, which introduces additional complexity that is unnecessary when AWS KMS can be used.
- E. Incorrect.
Incorrect. Client-side encryption is not necessary in this scenario because server-side encryption with AWS KMS already satisfies the encryption-at-rest requirement while being easier to manage.