SCS-C02 Question 324
Single answerYour organization needs to securely transmit sensitive customer data between its e-commerce application hosted on Amazon EC2 and an external partner's API. The security team mandates that the solution must ensure data confidentiality, integrity, and protection against unauthorized access during transit. What is the MOST secure and AWS-recommended approach to achieve this?
- A
Use HTTPS with TLS 1.2 or higher for communication between the application and the external API.
- B
Use a custom encryption algorithm for the data and transmit it over HTTP.
- C
Use a VPN connection between your AWS environment and the external partner.
- D
Use a symmetric encryption algorithm to encrypt the data and send it over an unencrypted channel.
Show answer and explanation
Correct answer: A
Explanation
To ensure confidentiality and integrity of data in transit, HTTPS with TLS 1.2 or higher is the most secure and AWS-recommended approach. TLS ensures that data is encrypted, protects it from tampering, and verifies the authenticity of the communication endpoints. It is the industry standard for securing sensitive data during transmission over the internet.
- A. Correct.
This is the correct choice. HTTPS with TLS 1.2 or higher ensures data confidentiality, integrity, and protection against unauthorized access during transit. It is the AWS-recommended and industry-standard approach for secure communication.
- B. Incorrect.
Using a custom encryption algorithm is not recommended because custom algorithms are often not thoroughly tested and may have security vulnerabilities. HTTP itself does not provide secure transmission, so this option does not meet the requirements.
- C. Incorrect.
While a VPN can provide an additional layer of security, it is not specifically designed for application-to-application communication over the internet. VPNs are typically used for secure network connectivity and might not address all aspects of data in transit security in this scenario.
- D. Incorrect.
Sending data over an unencrypted channel, even if encrypted with a symmetric algorithm, is not secure because the channel itself remains vulnerable to interception. This does not meet the requirement for secure data transmission.