SCS-C02 Question 307
Select 3Your company runs an application hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application handles sensitive customer data, and compliance mandates that the data must be encrypted in transit and at rest. Upon reviewing the setup, you find that the ALB is configured with an HTTP (port 80) listener only. Which of the following steps should you take to ensure compliance with encryption requirements?
- A
Add an HTTPS (port 443) listener to the ALB and configure it with an SSL/TLS certificate.
- B
Ensure that the backend EC2 instances enforce HTTPS communication by disabling HTTP on port 80.
- C
Enable AWS WAF on the ALB to protect against common web exploits and attacks.
- D
Use AWS Certificate Manager (ACM) to provision an SSL/TLS certificate for the ALB.
- E
Enable encryption at rest for the data stored on the EC2 instances' EBS volumes.
Show answer and explanation
Correct answers: A, D, E
Explanation
To meet compliance requirements for encrypting data in transit, the ALB must have an HTTPS listener configured with an SSL/TLS certificate, which can be provisioned using AWS Certificate Manager (ACM). Additionally, to ensure data is encrypted at rest, the EBS volumes attached to the EC2 instances must have encryption enabled. These steps collectively address the compliance mandates for securing sensitive customer data.
- A. Correct.
Correct. Adding an HTTPS listener to the ALB ensures that data is encrypted in transit between the client and the ALB.
- B. Incorrect.
Incorrect. While it's a good idea to secure backend communication, the question focuses on encryption compliance for data in transit and at rest. Disabling HTTP on backend instances is not necessary to meet this requirement.
- C. Incorrect.
Incorrect. AWS WAF enhances security but does not address encryption compliance for data in transit or at rest.
- D. Correct.
Correct. AWS Certificate Manager (ACM) simplifies the provisioning and management of SSL/TLS certificates, which is required for enabling HTTPS on the ALB.
- E. Correct.
Correct. Enabling encryption at rest on EBS volumes ensures that sensitive customer data stored on the EC2 instances is compliant with encryption requirements.