SAP-C02 Question 45
Select 3A financial services company is building a new web application that handles sensitive customer data, including Personally Identifiable Information (PII). The application will be hosted on AWS using Amazon EC2 instances and an Amazon RDS database. The company needs to ensure compliance with security and privacy regulations, including data encryption at rest and in transit, as well as access control measures. Which combination of AWS services and configurations should the Solutions Architect recommend?
- A
Enable Amazon RDS encryption using AWS Key Management Service (KMS) CMKs to encrypt data at rest.
- B
Use AWS CloudTrail to log API calls and monitor access to sensitive data.
- C
Configure SSL/TLS for connections to the Amazon RDS database and enforce it in the application.
- D
Rely on EC2 instance-level IAM roles for all access control needs without additional policies.
- E
Use Amazon S3 with default bucket settings to store application logs.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the company’s requirements for handling sensitive data securely, you must use encryption at rest (RDS encryption with KMS) and in transit (SSL/TLS for database connections). Monitoring and auditing access via AWS CloudTrail is also critical for compliance. Combining these measures ensures the application meets security and regulatory standards. The other options either do not address the security requirements or do not align with best practices.
- A. Correct.
Enabling Amazon RDS encryption using KMS ensures that the data at rest is encrypted, meeting compliance requirements for sensitive data.
- B. Correct.
AWS CloudTrail provides logging of API calls and access to resources, which is essential for monitoring and auditing compliance with security requirements.
- C. Correct.
Configuring SSL/TLS for database connections ensures encryption in transit, protecting data from interception during transmission.
- D. Incorrect.
While IAM roles are important, relying solely on them without additional fine-grained access control policies does not fully address security requirements.
- E. Incorrect.
Using Amazon S3 with default bucket settings does not ensure proper security or encryption for storing sensitive application logs.