SCS-C02 Question 500
Select 2An organization is designing a highly secure architecture for an application that processes sensitive financial data. According to the Security Pillar of the AWS Well-Architected Framework, which of the following actions should the organization take to reduce risk and improve security? (Select TWO.)
- A
Enable Amazon S3 server-side encryption for all data at rest.
- B
Use IAM users for application authentication instead of roles to ensure explicit access control.
- C
Implement AWS Config to monitor for non-compliant configurations.
- D
Open all inbound ports on security groups to allow easier troubleshooting.
- E
Deploy the application in multiple AWS Regions to ensure redundancy.
Show answer and explanation
Correct answers: A, C
Explanation
The AWS Well-Architected Framework's Security Pillar emphasizes implementing encryption (e.g., Amazon S3 server-side encryption) and monitoring compliance (e.g., AWS Config) to mitigate risks and enhance security. The other options either violate security best practices or address different pillars, such as reliability.
- A. Correct.
Correct. Enabling server-side encryption for Amazon S3 ensures that data at rest is encrypted, which aligns with best practices for protecting sensitive data.
- B. Incorrect.
Incorrect. Using IAM users for application authentication is not recommended because it is less secure and more difficult to manage compared to IAM roles, which provide temporary credentials and follow the principle of least privilege.
- C. Correct.
Correct. AWS Config helps monitor infrastructure and ensures compliance with security best practices, which is a key recommendation of the Security Pillar.
- D. Incorrect.
Incorrect. Opening all inbound ports on security groups is a violation of the principle of least privilege and significantly increases security vulnerabilities.
- E. Incorrect.
Incorrect. While deploying an application in multiple AWS Regions improves availability and redundancy, it does not directly address security concerns as outlined in the Security Pillar of the AWS Well-Architected Framework.