SCS-C02 Question 146
Select 2Your company is hosting a multi-tier web application on AWS. The application uses an Amazon RDS MySQL database for data storage, an Amazon EC2-based application tier, and an Amazon S3 bucket for static content. A recent security review revealed that sensitive customer data is being stored unencrypted in the database, and an attacker could potentially intercept this data in transit between the application and the database. As a Security Engineer, which actions should you take to secure the sensitive data both at rest and in transit?
- A
Enable Transparent Data Encryption (TDE) on the Amazon RDS MySQL database.
- B
Configure the application to use SSL/TLS when connecting to the RDS database.
- C
Enable S3 default encryption for the S3 bucket.
- D
Use AWS Key Management Service (KMS) to create a CMK and enable RDS encryption with the CMK.
- E
Set up a Network ACL to deny all inbound traffic to the RDS instance.
Show answer and explanation
Correct answers: B, D
Explanation
To secure sensitive data in the RDS MySQL database, it is essential to ensure encryption both at rest and in transit. Using AWS KMS to enable RDS encryption addresses encryption at rest, while configuring the application to use SSL/TLS ensures data in transit is protected. Combining these two solutions ensures that sensitive data is secure during storage and transmission.
- A. Incorrect.
Transparent Data Encryption (TDE) is not supported by Amazon RDS MySQL. Instead, AWS provides RDS encryption using KMS-managed keys to encrypt data at rest.
- B. Correct.
Using SSL/TLS ensures that data in transit between the application and the RDS database is encrypted, protecting it from interception.
- C. Incorrect.
While enabling S3 default encryption is a good security practice, it does not address the encryption of sensitive data in the RDS database or its transit.
- D. Correct.
Using AWS KMS to create a CMK and enabling RDS encryption ensures that data at rest in the database is encrypted.
- E. Incorrect.
Setting up a Network ACL to deny all inbound traffic to the RDS instance would block legitimate connections to the database and is not a solution for encrypting sensitive data.