SCS-C02 Question 286
Select 2A company is using Amazon RDS for its database workloads. The security team requires that all database connections be encrypted to meet compliance requirements. As a Security Engineer, what steps should you take to ensure compliance?
- A
Enable the 'Encrypt Connections' option in the RDS console.
- B
Ensure the RDS database is using an SSL/TLS certificate.
- C
Update database client applications to enforce SSL/TLS connections.
- D
Enable AWS Secrets Manager to manage database credentials.
- E
Use a security group to restrict access to the database only to trusted IP ranges.
Show answer and explanation
Correct answers: B, C
Explanation
To ensure compliance with the requirement for encrypted database connections, you must use SSL/TLS certificates for the RDS instance and configure client applications to enforce SSL/TLS connections. Network restrictions and credential management are important for overall security but do not directly ensure encryption of database connections.
- A. Incorrect.
There is no 'Encrypt Connections' option in the RDS console. Encryption of connections is achieved using SSL/TLS certificates and client-side configuration.
- B. Correct.
Using an SSL/TLS certificate ensures that the data in transit between the client and the RDS instance is encrypted.
- C. Correct.
Client applications must enforce SSL/TLS connections to ensure encrypted communication, as this is a critical step in securing the database connections.
- D. Incorrect.
AWS Secrets Manager is used to manage and rotate credentials securely but does not enforce encrypted connections.
- E. Incorrect.
Restricting access using security groups improves network security but does not ensure that connections to the database are encrypted.