SAP-C02 Question 630
Select 3An e-commerce company is running a microservices-based application deployed on Amazon ECS. The team uses AWS Fargate to manage containerized workloads without handling the underlying infrastructure. Recently, a new business requirement mandates that sensitive customer data processed by one of the containers must not be stored on any persistent storage at any time. Additionally, the solution must ensure encryption-in-transit for all communication between containers. What is the MOST appropriate solution to meet these requirements?
- A
Enable Task Definitions for Amazon ECS to use ephemeral storage and ensure no volumes are mounted.
- B
Configure AWS Fargate tasks to use a customer-managed CMK (Customer Master Key) for encrypting data at rest.
- C
Use AWS App Mesh with mTLS (mutual TLS) to secure communication between containers.
- D
Ensure that the container processing sensitive data writes only to /tmp within the container's file system, which is ephemeral by default.
- E
Configure Amazon ECS to use Elastic File System (EFS) for storage and enable encryption at rest.
Show answer and explanation
Correct answers: A, C, D
Explanation
The solution must ensure that sensitive data is not stored on persistent storage and that communication between containers is encrypted. Enabling ephemeral storage on ECS tasks, writing data to /tmp, and using AWS App Mesh with mTLS are the most appropriate solutions as they address these requirements. EFS and CMK for encryption at rest do not meet the no-persistent-storage requirement, making them unsuitable for this scenario.
- A. Correct.
Correct. By using ephemeral storage, data is not persisted after the container stops, which ensures compliance with the no-persistent-storage requirement.
- B. Incorrect.
Incorrect. While a customer-managed CMK can encrypt data at rest, this option does not prevent data persistence on storage, which violates the requirement.
- C. Correct.
Correct. AWS App Mesh with mTLS provides end-to-end encryption-in-transit between services, meeting the encryption-in-transit requirement.
- D. Correct.
Correct. By writing data to /tmp, which is ephemeral and tied to the container's lifecycle, the sensitive data will not persist beyond the task's execution.
- E. Incorrect.
Incorrect. Using EFS contradicts the requirement of 'no persistent storage' since EFS is designed for persistent storage solutions.