SOA-C02 Question 198
Select 3Your company has recently migrated a critical web application to AWS. To meet compliance requirements, you need to implement an infrastructure protection strategy that prevents unauthorized access to the application and ensures the data remains encrypted at all times. Which combination of actions should you take to achieve this goal?
- A
Use Security Groups to restrict access to the application’s EC2 instances to specific IP ranges.
- B
Enable Amazon S3 default encryption for all buckets used by the application.
- C
Deploy the application in a public subnet to allow direct access from the internet.
- D
Implement AWS Key Management Service (AWS KMS) to manage encryption keys for the application data.
- E
Disable logging to reduce the risk of exposing sensitive data in log files.
Show answer and explanation
Correct answers: A, B, D
Explanation
To implement an effective data and infrastructure protection strategy, it is crucial to restrict access to resources using Security Groups, ensure that data is encrypted at all times (e.g., using Amazon S3 default encryption and AWS KMS), and avoid practices that increase risk (e.g., deploying resources in public subnets or disabling logging). Combining these actions helps secure your AWS environment and meet compliance requirements.
- A. Correct.
This is correct. Security Groups act as a virtual firewall for EC2 instances, enabling you to control inbound and outbound traffic. Restricting access to specific IP ranges helps secure the application.
- B. Correct.
This is correct. Enabling default encryption for Amazon S3 ensures that all data stored in your S3 buckets is encrypted automatically, meeting compliance and data protection requirements.
- C. Incorrect.
This is incorrect. Deploying the application in a public subnet increases its exposure to the internet, making it more vulnerable to unauthorized access.
- D. Correct.
This is correct. AWS KMS allows you to securely manage encryption keys, ensuring that data remains encrypted both at rest and in transit, aligning with compliance requirements.
- E. Incorrect.
This is incorrect. Disabling logging is not recommended because logging is essential for monitoring and auditing access to your infrastructure and data.