SCS-C02 Question 233
Select 3Your organization runs a highly sensitive machine learning workload on Amazon EC2 instances. As part of a compliance requirement, all data on the EC2 instances must be encrypted at rest, and access to the instances must be restricted to authorized personnel only. Additionally, the solution must protect against unauthorized access and accidental exposure of sensitive data. Which combination of security controls should you implement to meet these requirements?
- A
Use Amazon EBS volumes with encryption enabled using AWS-managed keys (AWS KMS).
- B
Implement EC2 Instance Metadata Service Version 2 (IMDSv2) for enhanced security.
- C
Attach an IAM role to the EC2 instances to allow temporary access to sensitive data.
- D
Restrict SSH access to the EC2 instances by using security group rules to allow connections only from specific IP addresses.
- E
Enable EC2 Auto Recovery to automatically restart instances in case of failures.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure sensitive workloads on EC2 instances, encryption at rest is essential to protect data, while IMDSv2 helps secure instance metadata against unauthorized access. Restricting SSH access using security group rules ensures that only authorized personnel can access the instances. These controls collectively address the compliance and security requirements in the scenario.
- A. Correct.
Correct: Enabling Amazon EBS volume encryption ensures that all data stored on the EC2 instance is encrypted at rest, meeting the compliance requirement.
- B. Correct.
Correct: IMDSv2 enhances the security of EC2 instances by requiring session-oriented requests to the instance metadata service, protecting against unauthorized access to sensitive metadata.
- C. Incorrect.
Incorrect: While IAM roles provide secure access to AWS resources, they do not directly address the requirement to restrict unauthorized access or encrypt data at rest.
- D. Correct.
Correct: Restricting SSH access using security group rules ensures that only authorized IP addresses can connect to the EC2 instances, protecting against unauthorized access.
- E. Incorrect.
Incorrect: Enabling EC2 Auto Recovery is a resilience measure and does not address encryption, access control, or compliance requirements.