SCS-C02 Question 335
Select 2An application hosted on an Amazon EC2 instance needs to communicate securely with an Amazon RDS database. As a security engineer, you want to enforce the use of TLS for this communication to ensure data in transit is encrypted. What steps should you take to implement this securely?
- A
Enable SSL/TLS on the Amazon RDS instance and download the appropriate AWS-provided certificate bundle.
- B
Configure the EC2 instance to connect to the RDS instance using the database's endpoint and port without specifying a TLS option.
- C
Modify the database connection string in the application to explicitly use TLS parameters.
- D
Ensure that the security group attached to the RDS instance allows inbound traffic on the default database port.
- E
Disable encryption at rest on the RDS database, as it is unrelated to TLS encryption.
Show answer and explanation
Correct answers: A, C
Explanation
To secure communication between an EC2 instance and Amazon RDS, TLS must be explicitly enabled by configuring the RDS instance and the application connection string. This ensures that data in transit is encrypted and protected from interception. Simply enabling connectivity (e.g., via security groups) or configuring unrelated settings like encryption at rest does not enforce TLS.
- A. Correct.
Enabling SSL/TLS on the RDS instance and downloading the AWS-provided certificate bundle is required to ensure secure communication via TLS.
- B. Incorrect.
Connecting to the RDS instance without specifying a TLS option would result in an unencrypted connection, making it insecure.
- C. Correct.
Modifying the database connection string to explicitly use TLS ensures that the application enforces encrypted communication.
- D. Incorrect.
While allowing inbound traffic on the database port is necessary for connectivity, it does not enforce the use of TLS for encryption.
- E. Incorrect.
Disabling encryption at rest is unrelated to TLS and would decrease the overall security of the database.