SAP-C02 Question 64
Select 2Your organization is running an application that uses HTTPS for secure communication. The application needs to use a custom domain name, and you want to automate the management of SSL/TLS certificates, including automatic renewal. Additionally, the application stores sensitive customer data in an Amazon S3 bucket, which must be encrypted at rest using a customer-managed key. Which combination of AWS services should you use to meet these requirements?
- A
Use AWS Certificate Manager (ACM) to provision and manage the SSL/TLS certificate for the custom domain.
- B
Use AWS Key Management Service (AWS KMS) with a customer-managed key to encrypt the data stored in the Amazon S3 bucket.
- C
Use AWS Secrets Manager to manage the SSL/TLS certificates for your custom domain.
- D
Use Amazon S3 default server-side encryption with Amazon S3-managed keys (SSE-S3) to meet the encryption requirements.
- E
Use AWS Certificate Manager (ACM) for certificate management and AWS KMS for encrypting sensitive data.
Show answer and explanation
Correct answers: A, B
Explanation
The scenario specifies two distinct requirements: managing an SSL/TLS certificate for a custom domain with automation (fulfilled by AWS Certificate Manager) and encrypting sensitive data at rest in Amazon S3 using a customer-managed key (fulfilled by AWS KMS). Combining these services ensures secure communication and meets encryption compliance requirements.
- A. Correct.
Correct: AWS Certificate Manager (ACM) is designed to provision, manage, and deploy SSL/TLS certificates, including automatic renewals, making it the appropriate choice for managing certificates for a custom domain.
- B. Correct.
Correct: AWS Key Management Service (AWS KMS) with a customer-managed key allows you to encrypt data in Amazon S3 at rest while maintaining control over the encryption keys, fulfilling the requirement for customer-managed encryption.
- C. Incorrect.
Incorrect: AWS Secrets Manager is used for securely storing and managing secrets like database credentials or API keys, not SSL/TLS certificates.
- D. Incorrect.
Incorrect: While Amazon S3's default server-side encryption (SSE-S3) encrypts data at rest, it does not use a customer-managed key, which is explicitly required in the scenario.
- E. Incorrect.
Incorrect: While ACM can manage SSL/TLS certificates and AWS KMS can encrypt data, this is a vague statement that doesn't address the specific requirements of customer-managed keys and certificate automation in the scenario.