SCS-C02 Question 9
Single answerYour company is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive customer data in Amazon S3. You are tasked with ensuring that the data in transit between the clients and the S3 bucket is encrypted, and you need to ensure no unencrypted traffic is allowed. Which approach should you take to meet this requirement?
- A
Enable server-side encryption (SSE) for the Amazon S3 bucket.
- B
Require HTTPS by configuring an HTTPS listener on the ALB and redirect HTTP traffic to HTTPS.
- C
Use AWS Certificate Manager (ACM) to manage SSL/TLS certificates and associate them with the ALB.
- D
Create a bucket policy in Amazon S3 to deny any requests that do not use HTTPS.
Show answer and explanation
Correct answer: D
Explanation
To ensure data in transit is encrypted and unencrypted traffic is denied, you must enforce HTTPS for access to the S3 bucket. A bucket policy can be configured to deny any requests that do not use HTTPS, thereby meeting the requirement. Other options, such as enabling SSE or using ACM, address different aspects of security but do not explicitly enforce encrypted communication to the S3 bucket.
- A. Incorrect.
Enabling server-side encryption (SSE) protects data at rest in Amazon S3, not data in transit. This does not meet the requirement to ensure encrypted communication between clients and the bucket.
- B. Incorrect.
Requiring HTTPS for clients connecting to the ALB ensures encrypted communication to the load balancer but does not enforce encryption for traffic directly to the S3 bucket.
- C. Incorrect.
Using AWS Certificate Manager (ACM) simplifies SSL/TLS certificate management for the ALB, but it does not enforce encryption for data in transit to the S3 bucket.
- D. Correct.
Creating a bucket policy to deny requests that do not use HTTPS ensures that only encrypted communication is allowed for traffic in transit to the S3 bucket, meeting the requirement.